diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 000000000..cbdc57835
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,58 @@
+# Contributing to MUCGPT
+
+Thanks for your interest in contributing. MUCGPT is a multi-service AI
+assistant platform. This repository is the Elvatis evolution of the upstream
+[it-at-m/mucgpt](https://github.com/it-at-m/mucgpt) project; please keep changes
+compatible with the upstream architecture unless a change is explicitly scoped
+as an Elvatis-specific divergence.
+
+## Getting started
+
+1. Fork the repository and create a feature branch from `main`.
+2. Read `README.md`, `DESIGN.md`, and `PRODUCT.md` for the product and
+   architecture context before making non-trivial changes.
+3. Keep changes focused and small; one concern per pull request.
+
+## Repository layout
+
+- `mucgpt-core-service/` core backend service (Python).
+- `mucgpt-assistant-service/` assistant backend service (Python).
+- `mucgpt-assistant-service-migrations/` database migrations for the assistant
+  service.
+- `mucgpt-frontend/` web frontend.
+- `stack/` local and deployment stack definitions.
+- `docs/` project documentation.
+
+Python services use `uv` (`pyproject.toml`, `uv.lock`); the frontend uses the
+config in `eslint.config.mjs`.
+
+## Contribution rules
+
+- **English only** in code, comments, and documentation.
+- **No em dashes** (U+2014) in code, comments, or documentation. Use a regular
+  hyphen or restructure the sentence.
+- **No secrets in commits.** Never commit API keys, tokens, or `.env` files.
+- Keep the affected service's tests green; update or add tests in the same
+  change when you alter behavior.
+- Update documentation in the same pull request when behavior changes.
+
+## Pull request process
+
+1. Open a Pull Request against `main` with a clear description of the change and
+   why it is needed.
+2. Link any relevant issues and name the service or area you touched.
+3. Confirm the relevant service tests, lint, and build pass.
+4. Confirm no secrets are in the commit history.
+
+For major changes (new services, schema-breaking changes, cross-service
+contracts), open an issue first to discuss design and scope.
+
+## Reporting security issues
+
+Do not open a public issue for security vulnerabilities. Follow the process in
+[SECURITY.md](SECURITY.md).
+
+## License
+
+By contributing, you agree that your contributions are licensed under the terms
+of this repository's [LICENSE](LICENSE).
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..f0038ff5c
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,17 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you believe you have found a security vulnerability in this project, please report it responsibly:
+
+1. **Do not open a public issue.** Instead, send an email to **security@elvatis.com** with:
+   - A clear description of the vulnerability
+   - Steps to reproduce
+   - Expected and actual behavior
+   - Any PoC code or attachments (zip) if safe to share
+
+2. We will acknowledge receipt within **48 hours** and provide a timeline for fixes.
+
+3. Do not publicly disclose the issue until we have had a reasonable time to address it.
+
+We appreciate responsible disclosure.