SecuraTrack
Security and disclosure
Effective 26 October 2026
We welcome reports from security researchers and from customers. This page says what is in scope, how to report, what we commit to in return, and the protection you have when you follow it. How we host and protect the service is on the trust centre.
Scope
- app.securatrack.ai, the product.
- www.securatrack.ai, this website.
- The public surface of the connector workers.
Out of scope: the systems of our subprocessors, which you should report to them directly; denial of service; social engineering or phishing of our staff or our customers; physical attacks; automated scanning that degrades the service; and findings that require an already compromised device or account.
Rules of engagement
- Test only against accounts you own, or a trial you requested for the purpose.
- Do not access, change or delete data that is not yours. If you reach another organisation's data by accident, stop, do not keep it, and tell us.
- Do not run high-volume automated tools against production.
- Give us reasonable time to fix before disclosing publicly.
- Never use a finding for extortion.
How to report
Email security@securatrack.ai with the affected URL or component, the steps to reproduce, the impact as you understand it, and any proof of concept. If you need to send something encrypted, ask us and we will arrange it.
What we commit to
| Step | Our commitment |
|---|---|
| Acknowledgement | Within 3 business days |
| Triage decision and severity | Within 10 business days |
| Fix, critical | Within 7 days |
| Fix, high | Within 30 days |
| Fix, medium and low | With the next scheduled release |
| Coordinated disclosure | You may publish 90 days after the report, or sooner once the fix is live and we agree |
We will tell you when the fix ships, and credit you on this page if you would like that. We do not run a paid bounty programme today.
Safe harbour
If you make a good-faith effort to follow this policy, we consider your research authorised. We will not pursue or support legal action against you for it, including under computer-misuse and anti-circumvention laws, and we will not refer it to law enforcement. If a third party takes action against you for research that followed this policy, we will make it known that you acted under it.
This does not extend to our subprocessors' systems, which are not ours to authorise, and it does not excuse acts that are unlawful for other reasons. If you are unsure whether something is covered, ask us first.
Acknowledgements
No reports have been credited yet. Researchers who report a valid issue and want recognition will be listed here.