AI Governance & Disclosure Policy

This policy explains, in plain terms, how Nexus Trinity uses artificial intelligence in the Contract Reader, Deep Reports, API, and Discord bot (collectively, the "Service"), and what limits we've built around it.

One part of the Service does not use AI at all: Sanctions Screening. It checks a wallet or contract address directly against the U.S. Treasury's published OFAC sanctions list — an exact-match lookup against official government data, refreshed daily, not a model-generated judgment. Nothing in this policy's discussion of AI limitations, hallucination risk, or model behavior applies to that feature; its own limitation (it only catches an address that's directly named on the list, not indirect exposure) is described in the Limitation of Liability & Disclaimer §2 instead. Everything else on this page concerns the Contract Reader and Deep Reports, which do use an AI model as described below.

1. What the AI Does

The Service uses a large language model (LLM) to read the publicly verified source code of a smart contract and produce a written set of observations about specific patterns in that code — for example, whether the contract owner can pause transfers, mint unlimited tokens, or change fees without a timelock.

The AI does not:

• Execute, simulate, or interact with the contract on-chain
• Take any autonomous action on your behalf (it does not sign transactions, move funds, or interact with any wallet)
• Make a legal, financial-eligibility, employment, or safety-critical decision about any person
• Access anything beyond the source code (and, for context, basic public metadata like token name) fetched for that specific request

2. Why We Don't Publish a Safety Score

An earlier version of this product's design included a "risk score" and a "SAFE"/"unsafe" verdict. We deliberately removed it. A single verdict implies a certainty the underlying analysis cannot support — an LLM reading source code can miss issues, and "no issue found" is not the same as "no issue exists." Instead, the Service reports discrete, sourced observations, each in one of three states:

• Present — the pattern was found in the code, with a reference to what was found
• Absent — the pattern was checked for and not found
• Undetermined — the analysis could not conclusively determine this, usually because the relevant code was unavailable (e.g., an unverified proxy implementation) or too large to fully process

We report "undetermined" rather than guessing. This is a deliberate design choice, not a gap we haven't gotten around to fixing.

3. Known Limitations

You should assume the following about any AI-generated output from the Service:

• It can be wrong. LLMs can misread code, miss an issue a human researcher would catch, or describe a real pattern inaccurately.
• It only sees what's verified and fetched. Unverified contracts, proxy implementations that can't be resolved, or code beyond the size limit we process are reported as such, not silently skipped.
• It reflects a point in time. A contract's owner can change its behavior after the report is generated (via an upgrade, a role change, etc.), and the report will not reflect that.
• It is not a substitute for a manual audit. Our own human-delivered audit and retainer services (offered separately, under a signed agreement) involve manual verification that the automated tool does not perform.

4. Human Oversight

The automated Service (Contract Reader, Deep Reports, API, Discord bot) runs without a human reviewing each individual output before it's delivered to you — this is disclosed here so you know that. Our separately-contracted, human-delivered audit engagements are a different service line and do involve direct human review; if you've engaged us for that, the terms of that specific agreement govern, not this policy.

5. Data Sent to the AI Model

Only the fetched contract source code and minimal request context (e.g., the chain and address) are sent to the AI model to generate a report. We do not intentionally send personal data (your name, email, etc.) as part of the model prompt. See the Privacy Policy for what third-party model provider we use and how that provider handles data sent to it.

6. Feedback and Corrections

If you believe a report is inaccurate — either a false positive or something it missed — email security@nexustrinity.io with the contract address, chain, and what you believe is wrong. We review these reports; they may inform future improvements to the Service, though we do not guarantee any specific correction or turnaround time for the free tool.

7. Changes to This Policy

We may update this policy as the Service's AI usage evolves. Material changes will be reflected by an updated "Last updated" date.

8. Contact

NexusTrinityio LLC
security@nexustrinity.io