Security & Responsible Disclosure Policy

1. Purpose & our commitment to security

Inovamail (operated by [LEGAL ENTITY NAME]) is a privacy-first, end-to-end encrypted email service (the "Service"). Protecting our users is core to what we do, and we maintain administrative, technical, and physical safeguards designed to protect the Service and the data we hold.

No system is perfectly secure. We value the work of the security-research community and welcome reports of vulnerabilities from researchers acting in good faith. This Security & Responsible Disclosure Policy ("Policy") explains how to test and report responsibly, what protections we offer researchers who follow it, and what falls outside it. It supplements, and does not replace, our Terms of Service and Acceptable Use Policy.

2. Scope

In scope

Unless we state otherwise, the following are in scope for good-faith testing under this Policy:

• Inovamail's public-facing web application and marketing site at our primary domain ([WEBSITE URL]) and its subdomains that we operate;
• Inovamail's official client applications and our public IMAP/SMTP and API endpoints; and
• Vulnerabilities that could affect the confidentiality, integrity, or availability of the Service or user data.

Out of scope

The following are not in scope and must not be tested:

• Third-party services, subprocessors, or infrastructure that we do not own or operate (see our Subprocessors page) — test only assets that belong to Inovamail;
• The accounts, data, devices, or systems of any person other than yourself or an account you are expressly authorized to test;
• Physical facilities, personnel, and non-technical attack surfaces; and
• Findings that require a compromised device, a malicious insider, or physical access to a victim's unlocked device.

3. Safe harbor

If you make a good-faith effort to comply with this Policy during your security research, we will consider your research to be authorized, we will not pursue or support legal action against you in connection with that research, and we will not report you to, or ask, law enforcement to investigate you for it. Specifically:

• We will not bring a claim against you under laws such as anti-hacking or computer-misuse statutes, or under the anti-circumvention provisions of copyright law, for good-faith research that follows this Policy;
• We consider such research to be authorized conduct under our Terms of Service and Acceptable Use Policy, and we waive any restriction in those documents to the limited extent needed to permit the specific activities this Policy allows; and
• If a third party brings legal action against you for activity that complied with this Policy, we will take reasonable steps to make clear that your activity was authorized.

4. Rules of engagement

To qualify for safe harbor and any reward, you must follow all of these rules:

• Report promptly after discovering a suspected vulnerability, and report it only to us through the channel in Section 6;
• Do not access, modify, delete, or destroy data that does not belong to you, and do not attempt to view or exfiltrate other users' data;
• Test only accounts you own or are expressly authorized to test. Use your own test accounts; never use another person's account or data;
• No privacy violations. If you inadvertently encounter another user's personal data or content, stop, do not save or share it, and tell us in your report;
• No denial-of-service (DoS/DDoS) or other tests that degrade, disrupt, or impair the Service or its availability to others;
• No physical, social-engineering, or phishing attacks against Inovamail, its users, its staff, or its vendors;
• No high-volume automated scanning or brute-forcing that could degrade the Service; keep automated activity minimal and rate-limited;
• Use the minimum interaction necessary to demonstrate a vulnerability; do not pivot, escalate, or maintain persistence beyond what is needed for a proof of concept;
• Give us reasonable time to remediate before disclosing anything publicly, and coordinate any public disclosure with us (see Section 7); and
• Comply with all applicable laws and with this Policy, our Terms of Service, and our Acceptable Use Policy at all times.

5. Out of scope / non-qualifying reports

The following generally do not qualify for safe harbor or a reward, and we may decline to act on them. This list is illustrative, not exhaustive:

• Volumetric denial-of-service (DoS/DDoS) or resource-exhaustion attacks, and reports that require such activity to demonstrate;
• Spam, mail-bombing, or reports about the ability to send email;
• Best-practice or informational findings without a demonstrated, exploitable security impact (for example, missing security headers, absence of certain flags, SPF/DKIM/DMARC configuration opinions, TLS/cipher-suite preferences, or version-disclosure banners);
• Social-engineering, phishing, or physical attacks, and findings dependent on them;
• Reports from automated scanners without a validated, manually confirmed vulnerability;
• Clickjacking on pages with no sensitive state-changing action, self-XSS, CSRF on unauthenticated or low-risk endpoints, and login/logout CSRF;
• Vulnerabilities affecting only unsupported or end-of-life browsers, platforms, or software, or requiring a rooted/jailbroken or already-compromised device;
• Rate-limiting concerns without a concrete security impact; and
• Findings in third-party services or subprocessors we do not control (report those to the relevant provider).

6. How to report

Report suspected vulnerabilities to our security team:

Security — Inovamail
Email: [SECURITY EMAIL]
Encryption (optional): our PGP key is available at [SECURITY PGP KEY] for sensitive reports.

To help us triage quickly, please include:

• A clear description of the vulnerability and its potential security impact;
• Step-by-step reproduction instructions and a minimal proof of concept;
• The affected asset, URL, or endpoint, and any relevant request/response details;
• Any test account you used (use your own test accounts only) and the date/time of testing; and
• Your name or handle for acknowledgment, and how you would like to be credited (or that you prefer to remain anonymous).

7. Our commitments

When you report in line with this Policy, we will make reasonable efforts to:

• Acknowledge receipt of your report within a reasonable time;
• Triage and validate the report and assess its severity;
• Keep you reasonably informed of our progress toward remediation; and
• Credit you, where you wish to be credited, once the issue is resolved.

We ask that you keep the details of any vulnerability confidential until we have had a reasonable opportunity to remediate and we agree on timing for any public disclosure. We aim to work with you toward coordinated disclosure; we do not commit to a fixed timeline and reserve discretion where user safety requires it. The timeframes in this section are goals, not contractual obligations.

8. Rewards

Any reward or "bounty" is entirely discretionary. We do not operate a guaranteed bug-bounty program, and no reward is promised or guaranteed by this Policy. Where we choose to offer a reward, the existence and amount are determined by us in our sole discretion, based on factors such as the severity, novelty, quality of the report, and whether you followed this Policy, and are subject to applicable law and any eligibility requirements (including that you are not barred by sanctions or law from receiving a reward). Duplicate reports, and issues already known to us or otherwise ineligible under Section 5, are not eligible.

9. Changes to this policy

We may update this Policy at any time. The version in effect at the time of your research governs that research. Material changes take effect when we post the updated Policy, indicated by the "Last updated" date above. Please review this page before beginning any testing.