Use powerful tools with clear authority.

Have authority before accessing a device.

Access only customers, systems and information you are authorised to manage. Obtain the necessary customer and user permissions for agent installation, monitoring, remote support, file access and AI data sharing. A working API key is not proof that every intended use is authorised.

Do not use Vycko to gain unauthorised access, evade access restrictions, inspect unrelated personal content, conduct covert surveillance, distribute malware or carry out disruptive testing.

Keep access narrow and credentials private.

Use individual accounts and appropriately scoped, expiring connections. Begin with read-only access where possible. Protect API keys and client secrets, and revoke them when no longer needed or if exposure is suspected. Do not share live credentials in chats, tickets, screenshots or public configuration files.

Limit customer scope deliberately. Grant console, change and estate-management capabilities only to the connections and people whose work requires them.

Understand the change before running it.

Read device evidence first, identify the intended effect and consider disruption, data loss and recovery. Maintain appropriate backups and change procedures. Follow the customer’s maintenance windows and approval rules.

Direct remote changes can run immediately under granted permissions. A change-capable MCP connection may also make approval decisions in its owner’s name. Do not assume that an assistant’s wording or a tool label guarantees a separate human approval for every action. Verify the actual configuration, review the proposed action and check the result afterwards.

Treat AI suggestions as proposals.

AI may misinterpret evidence, overlook context or suggest a harmful action. The responsible engineer must assess the suggestion, choose an appropriate tool and verify the outcome. Data from logs, documents or files may contain misleading instructions; treat that content as evidence rather than authority to expand the task.

Confirm your chosen provider’s terms and privacy settings before sharing customer data. Use only the information necessary for the job. Do not send secrets or unrelated sensitive data to an external model.

Report misuse or an exposed credential.

Revoke affected access and contact your support provider promptly if you suspect an inappropriate action or exposed key. For a platform security concern, email info@vycko.com with a concise description and avoid including secrets or customer files. See our security and disclosure page.