Vulnerability Disclosure Policy

The short version. If you find a security vulnerability in Pazau, tell us at security@pazau.com or through our bug bounty program on HackerOne. Test only against your own accounts, don't access other people's data, and give us reasonable time to fix the issue before you share it. If you follow this policy, we won't pursue legal action against you, and we'll say thank you, often with a reward. We acknowledge reports within 2 business days.

Our commitment

Pazau protects conversations for airlines, insurers, banks, and health systems. Independent security research makes that protection stronger. This policy tells you how to report a vulnerability, what we ask of you, and what you can expect from us. It is maintained by our security team under Omar Haddad, CISO.

How to report

Submit through either channel:

• Bug bounty program: hackerone.com/pazau. This is the fastest route and the only route eligible for rewards.
• Email: security@pazau.com. Encrypt sensitive details with our PGP key, published at pazau.com/.well-known/pgp-key.txt (fingerprint 7C1E 44A9 0B3D 5F28 9E61 A0C4 3D72 18BF E905 6A1D).

Our contact details are also published in pazau.com/.well-known/security.txt, following RFC 9116.

A good report includes:

• the affected asset (URL, API endpoint, app version, or phone number);
• a description of the vulnerability and its impact;
• step-by-step reproduction instructions, with requests and responses or a short video;
• the account or workspace IDs you used for testing;
• any suggested mitigation.

One vulnerability per report, please, unless you are chaining issues to show impact.

Scope

In scope

Out of scope

• Customers' own websites, systems, and phone numbers, even if they use Pazau. Report those to the customer.
• Third-party services we use, such as Cloudflare or AWS, unless the issue arises from our configuration. Report issues in their products to them directly.
• status.pazau.com, which is hosted by a third-party status page provider.
• AI outputs that are merely inaccurate, offensive, or off-topic within your own workspace, without a security impact. Report these to responsible-ai@pazau.com instead.

Not eligible

We generally don't accept reports of:

• missing security headers or cookie flags without a demonstrated exploit;
• clickjacking on pages with no sensitive actions;
• SPF, DKIM, or DMARC configuration on non-sending domains;
• rate limiting on non-authentication endpoints;
• self-XSS, logout CSRF, or content spoofing without meaningful impact;
• vulnerabilities requiring a rooted or jailbroken device, or outdated browsers;
• software version disclosure, banner grabbing, or descriptive error messages;
• automated scanner output without validation;
• social engineering of Pazau employees or customers, and physical attacks.

Rules of engagement

To stay within safe harbor:

• Use your own accounts. Create a free trial workspace, or request a researcher sandbox through HackerOne. Use your @wearehackerone.com alias when signing up.
• Don't access, modify, or delete data that isn't yours. If you accidentally access someone else's data, stop, don't keep or share it, and tell us immediately.
• Don't degrade the service. No denial-of-service testing, volumetric attacks, or automated scanning above 10 requests per second.
• Don't send messages or place calls to real people. Voice and messaging tests must target your own numbers or our listed test numbers.
• Don't pivot. Once you've shown impact, stop. Don't use a vulnerability to gain further access or maintain persistence.
• Keep it confidential until we've fixed the issue and agreed on disclosure, as described below.
• Follow the law and the HackerOne platform rules.

Safe harbor

When you conduct research in good faith and in compliance with this policy, we consider your research authorized. Specifically:

• we won't initiate or support legal action against you, including under the Computer Fraud and Abuse Act, the DMCA's anti-circumvention provisions, the UK Computer Misuse Act, or similar laws, and we will waive restrictions in our Website Terms of Use and Acceptable Use Policy that would otherwise prohibit your research;
• if a third party brings legal action against you for research conducted under this policy, we will make it known that your actions were authorized by us;
• we won't report you to law enforcement for research within this policy.

If you're unsure whether something is permitted, ask us at security@pazau.com before you proceed. Safe harbor doesn't extend to research that violates the rules above, and it can't bind third parties.

Our response timelines

We rate severity with CVSS v4.0, adjusted for real-world impact on Customer Data. Our remediation targets are:

If a vulnerability affects Customer Data, we follow the incident response and customer notification commitments in our Data Processing Addendum and Security Addendum.

Rewards

We pay rewards through HackerOne for eligible, previously unreported vulnerabilities, based on severity and quality of the report:

Cross-tenant data access and remote code execution are always rated Critical. The first report of an issue receives the reward. We may pay bonuses for exceptional reports, such as a working fix or a chain that shows novel impact. We can't pay researchers in sanctioned countries or current Pazau employees and contractors.

Coordinated disclosure

We want researchers to publish their work. Once an issue is fixed, you may disclose it after giving us a draft to review, and we'll respond within 7 days. We ask you to wait until the fix is deployed or 90 days have passed since your report, whichever is sooner, unless we agree on an extension for a complex fix. We credit researchers in our security acknowledgments page in the Trust Center unless you ask us not to.

Where a vulnerability affects third-party software, we coordinate with the vendor and may request a CVE.

Questions

Email security@pazau.com. For privacy questions, contact privacy@pazau.com.