Security & Responsible Disclosure

Email [email protected] with:

• A description of the issue and its potential impact.
• Steps to reproduce it, including affected URLs, requests or components.
• Any proof-of-concept code, screenshots or logs.
• How you would like to be credited, if at all.

In scope: resilientprivacy.com and its subdomains, including the Resilient Privacy platform at app.resilientprivacy.com and its API at api.resilientprivacy.com.

Out of scope: denial-of-service, social engineering or phishing of our staff, physical attacks, third-party services we do not control, automated scanner output without a demonstrated impact, missing best-practice headers without a working exploit, and systems belonging to our customers.

• Test only against accounts and data you own or have explicit permission to use.
• Stop as soon as you confirm a vulnerability; do not access, change, keep or share other people’s data.
• Do not degrade service for other users.
• Give us reasonable time to fix the issue before any public disclosure. We aim to agree a disclosure date with you, typically within 90 days.

• Acknowledgment that we received your report within 2 business days.
• An initial assessment and severity rating within 10 business days.
• Regular updates until the issue is resolved, and credit in our acknowledgments if you want it.

If you make a good-faith effort to follow this policy, we will consider your research authorized, will not pursue legal action against you for it, and will not ask law enforcement to do so. If a third party brings action against you for activity that complied with this policy, we will make it known that your actions were authorized. This does not apply to activity that violates the law or this policy.

This policy authorizes good-faith research on our own systems only. It does not authorize testing of our customers’ systems or any third party’s systems, and it does not create a services relationship or any guarantee that our systems are free of vulnerabilities. Any dispute about this policy is governed by Delaware law and resolved under the dispute sections of our Terms of Use, including binding individual arbitration and the jury trial waiver.

We do not currently run a paid bug bounty program. We still welcome reports under this policy and credit researchers who want it.

We apply the same practices we deliver to customers:

• Encryption of data in transit and at rest.
• Single sign-on, multi-factor authentication and least-privilege access for staff.
• 24/7 monitoring of our own environment by our security operations team.
• Regular penetration testing and vulnerability management.
• Security awareness training for all staff at hire and every year after.
• Background checks before hire where local law allows, and confidentiality agreements for all staff and contractors.

The company does not hold an audit report or certification such as SOC 2 or ISO 27001. Our team holds individual industry certifications, including CISSP, CISM, CISA, OSCP, CEH, Security+ and CCNA. Customers can request our security documentation through their account team.