Security & Vulnerability Disclosure
Last updated November 10, 2026
November 10, 2026 · Machine-readable version: /.well-known/security.txt (RFC 9116) on every IEMSuite site
Reporting a vulnerability
E-mail [email protected] with the affected URL or component, steps to reproduce, impact and how to reach you. We acknowledge within 3 business days, triage within 7 days, and target fixes of 7 days for critical, 30 days for high and 90 days for medium severity. Please test against the public demo (Playground) where possible and never against other customers' data.
Safe harbour
We will not pursue legal action against researchers who act in good faith: avoid privacy violations and service disruption, do not access or modify data beyond what is needed to demonstrate the issue, and give us reasonable time (90 days) to fix before public disclosure.
Out of scope
Denial of service, social engineering, physical attacks, issues in third-party services (report them to the provider), missing best-practice headers without demonstrated impact, and automated scanner output without a proof of concept.
How we protect data
Encryption in transit and of credentials at rest, tenant isolation, role-based access with optional or mandatory two-step verification, audit logging, rate limiting, signed webhooks, independent penetration testing, dependency scanning, EU hosting with daily backups, and a documented 72-hour breach-notification runbook. Details for customers: DPA Annex II.
Recognition
We thank reporters here with their consent. No monetary bounty is offered at this stage.
Questions: [email protected]