Draft for legal review. This text is a placeholder. The owner must approve it before launch.
Security policy
Reporting a vulnerability
Tell us if you find a security issue in Oncrypt. Email [Security contact email address] with a clear description, the steps to reproduce the issue and the affected address.
Please keep the issue private until we confirm a fix.
Scope
In scope: the Oncrypt website and product at [In scope domains, to confirm].
Out of scope: third party services, social engineering, physical attacks and denial of service testing.
Safe harbour
If you report in good faith and follow this policy, we will not take legal action against you.
[Placeholder: safe harbour terms, to confirm with counsel.]
Response times
We acknowledge each report within [Acknowledgement time, to confirm]. We keep you updated until the issue is closed.
[Placeholder: triage, fix and disclosure targets, to confirm.]
Contact us
Security contact: [Security contact email address].
For general questions, email [Contact email address]. You can also read how we protect our own systems on the trust center page.