Found a vulnerability? Tell us first

Scope

In scope:

• The panel application and its API
• The marketing site
• Pages opened through shareable links: proposal page, reconciliation approval page, customer statement
• Authentication, session management and data isolation between companies

Out of scope:

• Denial of service (DoS, DDoS) and load testing
• Social engineering, phishing and physical access attempts
• Third-party services we do not operate (our subprocessors and services tenants connect); report those to the provider
• Findings without demonstrated impact, such as a missing security header, SPF or DMARC settings, or clickjacking on pages without a session

What not to do

• Access, modify, delete or exfiltrate data belonging to other users or companies
• Run automated scans or heavy request volumes that degrade the service
• Leave persistent access in the system (backdoor, user account, scheduled job)
• Disclose the finding publicly or to third parties before a fix ships
• Use the finding to demand payment

If you come across personal data during research, stop, do not keep the data and mention it in your report.

Good-faith research safe harbor

We consider research carried out in good faith and in line with this policy to be authorized, we will not start legal proceedings against you, and if a third party does, we will state that you followed this policy. If you are unsure whether something is in scope, ask through the contact page before testing.

security.txt

Our security reporting channel and the address of this policy are published in the /.well-known/security.txt file in RFC 9116 format.