Responsible disclosure

If you make a good-faith effort to follow this policy, we will not pursue or support legal action against you, and we will not report you to law enforcement. We consider your research authorised under the computer misuse laws that apply to us, and we will say so in writing if a third party questions it.

Good faith means: you stayed inside the scope below, you stopped as soon as you confirmed a finding, you did not access, modify or retain anyone else's data beyond the minimum needed to demonstrate the issue, and you gave us a reasonable chance to fix it before telling anybody else.

If you are unsure whether something is in scope, ask first. Asking never counts against you.

• The portal, the console and the public marketing site on any domain we operate
• The API, including authentication, authorisation and tenant isolation
• Anything that crosses a tenant boundary, which we treat as the most serious class of finding there is
• Anything that de-anonymises a message sender, or narrows the set of possible senders, which we treat equally seriously
• Role and redaction bypasses, privilege escalation, and gaps in the audit trail
• Prompt injection that changes what the platform enforces, rather than what a single summary reads like

These are either known, accepted, or not vulnerabilities in the sense this policy is about. Reporting them is not a problem, but it will not be treated as a finding.

• Findings from automated scanners without a demonstrated, working exploit
• Denial of service, volumetric testing, or anything that degrades service for real users
• Social engineering of our staff, our customers, or the people who write into a channel
• Physical attacks, and anything touching an office or a person
• Missing hardening headers or weak cipher suites with no demonstrated impact
• Self-inflicted findings requiring a rooted device, a hostile browser extension, or an already-compromised account
• Reports about the marketing site's media delivery, which is documented in the sub-processor list

• Test against your own trial tenant. Start one free if you do not have one, and tell us the tenant name in your report
• Never test against another institution's tenant, and never against a live portal carrying real messages
• If you encounter real personal data, stop, do not save it, and tell us immediately in the report
• Do not run destructive tests, and do not leave test data behind in anything that is not yours
• Give us ninety days before public disclosure, or less if we agree it in writing

• Acknowledgement from a named person inside one working day
• A triage decision, with severity and our reasoning, inside five working days
• A fix timeline in writing once triage completes, and progress updates until it ships
• Credit in the changelog under whatever name you choose, or no credit at all if you prefer
• We will tell you when the fix is live, and we will not quietly close your report

This policy covers unsolicited research. If you are a customer on Enterprise or above, you may commission your own penetration test against a scope we agree in advance, with a named contact on our side, and we fix what you find on a timeline agreed in writing. Dedicated deployments additionally receive our annual penetration test in full.

That route is contractual rather than discretionary, and it is set out in the data processing agreement.

We do not currently run a paid bug bounty, and we would rather say that plainly than imply a reward that does not exist. We offer safe harbour, a fast human response, public credit if you want it, and a fix. If that changes, this page changes with it.