Privacera Platform master publication

Table of Contents

Coordinated Vulnerability Disclosure (CVD) Program of Privacera

:

As part of its commitment to safeguarding sensitive data, Privacera welcomes contributions from security researchers. We encourage members of the security community to notify us of any identified vulnerability in our products, infrastructure, or information technology systems.

Security researcher responsibilities

Privacera will not pursue legal action against those security researchers acting in good faith and in adherence with the following instructions:

  • Comply with all applicable laws, regulations, and contractual obligations.

  • Avoid any testing (or hacking) of production environments. Use test or development environments to perform vulnerability research whenever possible.

  • Do not modify or copy data in any account or system for which you do not have legal authority to do so.

  • Do not disseminate information regarding any vulnerability you identify to any party not under a legally binding obligation of confidentiality to you or your organization.

  • Submit reports regarding vulnerabilities in English to security@privacera.com

    • Do not include sensitive information (other than information related to the vulnerability details) in any screenshots or other content you provide to us.

    • Provide clear steps for reproduction of the vulnerability in question, either through written instructions, screen recordings, or preferably both.

  • Coordinate with Privacera to identify a public release date for announcing the discovery and resolution of the vulnerability.

  • Respond to follow-up requests for information from Privacera.

  • By submitting a vulnerability, you agree that:

    • Your participation in the Privacera CVD program does not create any kind of employment relationship or partnership between you and Privacera. You may not represent yourself as a Privacera employee or someone who is affiliated in any way with Privacera.

    • You may not utilize any Privacera logos, trademarks, or service marks without written authorization from Privacera.

    • Participating in the Privacera CVD program does not grant you, or any other third party, any rights to Privacera intellectual property, product, or service. All rights not otherwise granted within this policy are expressly reserved by Privacera.

    • You hereby assign to Privacera all rights, title, and interest, including all intellectual property rights, for all vulnerability reports submitted.

    • You further warrant that you have the right to assign all such rights, titles, and interests to Privacera for the submissions, and that your participation in the Privacera CVD program does not violate any agreement you may have with any other third party, such as your employer.

Privacera responsibilities

For valid submissions complying with the above, Privacera will:

  • Acknowledge receipt within seven (7) calendar days.

  • Assess the finding to determine its severity and vulnerability, if any.

  • Reserve the right to not accept a report, for example, due to a lack of reproducibility, advising researcher(s) as to the reasons why.

  • Develop a resolution plan and take appropriate action depending on the severity and likelihood of exploitation of the vulnerability in question.

  • Provide the researcher with public recognition (if requested), if Privacera--at its sole discretion--decides that the report should result in a publicly communicated software fix.

  • Retain ownership over any information submitted to Privacera.

  • Not incur any obligations from the submission of said information.

Important

Privacera reserves the right to modify or terminate this program at any time without prior notification by posting an updated version of this document.