1. Purpose
We take the security of our services seriously. If you find a vulnerability in an Infaris service, please report it to us, so we can fix it before anyone abuses it.
2. Scope
All Infaris services and websites under infaris.com, ipulse.one and the product domains, including Guard, Files, QR, Sync and the Guard agent.
Out of scope: websites and systems of our customers, even when they are monitored with Guard; services of our suppliers; and reports without a demonstrable security risk, such as a missing header without a working abuse scenario.
3. How to report
E-mail [email protected], in Dutch or English. Describe the vulnerability, the steps to reproduce it and the possible impact. You may report anonymously.
4. What we ask of you
- Report the vulnerability as soon as possible after discovering it.
- Do not use the vulnerability further than needed to demonstrate it. Do not view, change or delete other people's data. If you do touch personal data, stop and tell us.
- Do not carry out attacks that affect availability, such as DDoS, no social engineering or phishing, and no physical attacks.
- Do not place malware and do not leave a backdoor.
- Do not share the vulnerability with anyone until we have fixed it, or until 90 days after your report, whichever comes first. We are happy to discuss another moment.
- Where possible, test with your own account and your own organisation.
5. What we do
- We confirm your report within 3 business days.
- Within 10 business days we give a first assessment and an expected time to fix.
- We keep you informed of progress.
- If you act in line with this policy, we will not report you to the police or take legal action against you because of your report.
- We treat your report confidentially and do not pass your details to third parties without consent, unless the law requires us to.
- If you wish, we credit you as the reporter once the issue is fixed.
6. Reward
We have no bug bounty programme. For a report of a serious vulnerability we did not know about, we may give a token of thanks. We decide the form and amount case by case.
7. Personal data of reporters
We only use your name and e-mail address to handle the report. We keep them until 2 years after closure, as described in the privacy statement.