Security & disclosure
The security posture and responsible disclosure process planned for the service.
TODO(legal-review) · Draft for review. This policy is not approved for a live service.
Report a concern
A verified security contact and disclosure address will be published after the business domain is confirmed. Do not submit sensitive exploit details through an unverified address in this preview.
Testing boundaries
A published disclosure policy will define permitted scope and reporting expectations. Do not access other people’s information, disrupt availability or make destructive changes. No safe-harbor promise is made by this draft.
Planned controls
Staff access is intended to require organizational SSO, MFA, an allowlist and auditable access to cases. Production readiness requires verification of those controls, backup restoration and incident escalation.
What is confirmed today
This local preview contains fictional sample documents and draft content. Production security assurance, certifications and audit claims are not asserted.
Something wrong now,
or planning ahead?
Tell us where you are. We’ll help you understand the route forward.