Response Cycle
- Detection: Monitoring of our Swiss-hosted infrastructure and reports received at [email protected].
- Containment: Isolate affected systems; rotate infrastructure credentials and keys; suspend specific API endpoints if necessary.
- Eradication: Patch the vulnerability; remove or rebuild any affected components.
- Recovery: Redeploy from clean images; restore service continuity; confirm integrity of audit records.
Customer Notification
- Severity 1 (Personal-data breach): Affected customers notified within 72 hours via email and in-app alert.
- Severity 2 (Service degradation): Affected customers updated by email until service is restored.
Reporting a Vulnerability
Report suspected vulnerabilities to [email protected]. Our Vulnerability Disclosure Policy sets out what we ask of researchers and what you can expect from us.
