1.0 Our commitment
In short: if you find a security problem in SOVRINT, email security@sovrint.com. Research that follows this policy is authorized, we will not take legal action over it, and we will work with you to fix the issue and agree on disclosure.
SOVRINT is used by institutions whose work depends on the integrity and confidentiality of their analysis. We take reports from the security community seriously, act on them, and treat the people who make them as partners.
2.0 How to report
Send reports to security@sovrint.com. Please do not use public channels, social media or the general contact form for vulnerability details. To help us reproduce and prioritize the issue, include:
- the affected URL, endpoint or component, and the environment you tested;
- step-by-step instructions to reproduce, with request and response samples, screenshots or a proof of concept where it is safe to share one;
- your assessment of the impact and, if you use it, a CVSS score;
- the date and time of testing and any identifiers we can use to find your activity in our logs;
- how you would like to be credited, if at all, and how we can reach you.
We do not currently publish a PGP key. If you need to send sensitive material encrypted, email us first without the details and we will arrange a secure channel with you.
3.0 Scope
| In scope | Out of scope |
|---|---|
| www.sovrint.com, including the contact and briefing request forms and the intake API | Services operated by third parties on their own infrastructure, including our hosting and cloud providers. Report those to the provider concerned. |
| The SOVRINT platform: sign-in, workspace pages and workspace APIs | Denial of service, volumetric attacks, or any testing that degrades the service for others |
| Authentication, session handling and the boundaries between customer workspaces | Social engineering, phishing or physical attacks against SOVRINT staff, customers or facilities |
| Access-control and injection flaws, data exposure, and logic errors that affect confidentiality or integrity | Reports based only on automated scanner output, version banners or missing hardening headers without a demonstrated impact |
Findings on out-of-scope systems are still welcome as information, but they are not covered by the safe harbour below unless the third party’s own policy allows the testing.
4.0 Rules for research and safe harbour
When testing, you must:
- use only accounts you own or that we have provided for testing, and never access another person’s or customer’s data. If you need a test account, ask us before you begin;
- stop as soon as you have enough evidence to demonstrate the issue. Do not exfiltrate, modify or delete data, pivot to other systems, or maintain access;
- if you encounter personal data or Customer Content, stop, do not copy it, and tell us in your report;
- keep the details of the vulnerability confidential until we agree on disclosure under section 5.0;
- not demand payment as a condition of reporting or of withholding disclosure.
Research conducted in good faith and in line with this policy is authorized by SOVRINT. We will not bring or support legal action against you for it, including under the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act’s anti-circumvention provisions, or equivalent laws, and we will not refer such research to law enforcement. If a third party starts legal action against you in connection with research covered by this policy, we will make it known that your activity was authorized. This safe harbour does not cover activity that goes beyond the rules above.
5.0 What to expect from us
| Stage | Target |
|---|---|
| Acknowledgement of your report | Within 3 business days |
| Initial assessment and severity | Within 10 business days |
| Remediation of confirmed issues | Critical and high severity as a priority; others within a timeline we agree with you |
| Coordinated disclosure | When a fix is deployed, or 90 days after your report if a fix is not yet available, unless we agree a different date |
We will keep you informed as we investigate, tell you when the issue is fixed, and credit you in our disclosure if you wish. SOVRINT does not currently run a bug bounty programme and does not pay for reports. We may, at our discretion, offer recognition for significant findings.
6.0 How we protect the service
To help you focus your research, the following controls are already in place: all traffic is encrypted and pinned to HTTPS with strict transport security; passwords are stored as salted hashes; sessions use signed tokens in secure cookies; each workspace is separated by tenant and access inside it is controlled by role; administrative actions are written to audit logs; public endpoints are rate limited and protected against automated submission; and a content security policy and related browser protections are applied to every response. Customers can request more detailed security documentation through their account team.
7.0 Contact
Security reports: security@sovrint.com. Questions about this policy or about how personal data is handled: see the Privacy Policy or use the contact page.