Vulnerability Disclosure Policy

Keeping our customers' data safe matters to us. If you believe you have found a security vulnerability in a Delphitek service, we want to hear about it and will work with you to understand and fix it.

1. How to Report a Vulnerability

Email info@delphitek.com with the subject line "Security vulnerability report". Please include:

• A description of the vulnerability and its potential impact
• The affected URL, page, API endpoint or component
• Steps to reproduce it, including any proof-of-concept
• How we can contact you for follow-up questions

Please do not include any customer or personal data in your report beyond the minimum needed to describe the issue.

2. What to Expect From Us

• We aim to acknowledge your report within 5 business days.
• We will investigate, keep you informed of our progress, and let you know when the issue is resolved.
• If you would like to be credited for the finding, let us know and we will be happy to do so once it is fixed.

3. Scope

This policy covers:

• The Delphitek Compliance Readiness Platform at compliance.delphitek.com, including its customer portal and API
• The Delphitek endpoint assessment agent
• The Delphitek IT consulting website at delphitek.com

Out of scope: third-party services we use (for example Microsoft or Stripe), which should be reported to those providers directly, and any customer's own environment or Microsoft 365 tenant.

4. Guidelines for Researchers

When investigating a vulnerability, please:

• Only access, modify or delete data that belongs to you. If you encounter anyone else's data, stop, do not keep a copy, and report it to us.
• Do not carry out denial-of-service testing, spam, social engineering or physical attacks.
• Avoid automated scanning that could degrade the service for our customers.
• Give us reasonable time to fix the issue before disclosing it publicly, and agree a disclosure date with us.

5. Good-Faith Research

If you act in good faith and follow this policy, we will not initiate legal action against you in relation to your research, and we will work with you to understand and resolve the issue.

6. Rewards

We do not currently run a paid bug bounty program, but we genuinely appreciate every report made in good faith.

7. Contact

Base 60 Capital Pty Ltd (trading as Delphitek)
Email: info@delphitek.com
Machine-readable contact details: /.well-known/security.txt