Responsible vulnerability disclosure

Security Policy

Report a vulnerability responsibly before public disclosure. Protect other customers, stop if you encounter sensitive data and provide enough detail for us to reproduce the issue.

Report a security issueRead security.txt

Responsible vulnerability disclosure

If you believe you have found a security issue, please report it to us before making it public. We will review your report, investigate the issue, and take appropriate action where necessary.

Our goal is to handle reports transparently, responsibly, and without creating unnecessary risk for users, systems, data, or third-party services.

Systems and services in scope

This policy applies to:

  • iamvera.ai and public services operated under that domain;
  • authentication, session handling, API endpoints, public forms and document-processing workflows operated by IamVera.ai;
  • a customer instance, account or document only where you own it or have explicit written authorisation to test it.

Do not test another customer’s tenant, account, session, document or data.

Reports and testing outside scope

The following are not considered eligible security reports unless they demonstrate a clear, practical security impact:

  • Automated scanner output without verified exploitability
  • Missing security headers without a demonstrable risk
  • Denial-of-service testing
  • Social engineering, phishing, or physical attacks
  • Issues affecting third-party AI providers, hosting providers, or external services outside our direct control
  • Reports requiring access to accounts, systems, or data that you do not own or have explicit permission to test

Testing rules and prohibited actions

When conducting security research, please:

  • Do not access, modify, delete, or exfiltrate data that does not belong to you
  • Do not disrupt the availability or integrity of our services
  • Do not attempt denial-of-service attacks
  • Do not use social engineering against our staff, users, or suppliers
  • Stop testing immediately if you encounter sensitive data and report the issue responsibly
  • Provide enough technical detail for us to reproduce and verify the issue

How to report a security vulnerability

Please send security reports to:

security@iamvera.ai

Include:

  • A clear description of the vulnerability
  • The affected URL, endpoint, or component
  • Steps to reproduce the issue
  • The potential impact
  • Any relevant screenshots, logs, proof-of-concept code, or HTTP requests

If security@iamvera.ai is unavailable, reports may also be sent to hello@iamvera.ai.

Response process and disclosure expectations

We aim to acknowledge valid security reports within a reasonable timeframe. After receiving a report, we will assess the issue, determine its severity, and prioritise remediation based on risk.

We may contact you for additional information if required. Once the issue has been resolved, we may acknowledge your contribution if you would like to be credited.

No bug bounty programme

I am Vera does not currently operate a paid bug bounty programme. Submitting a report does not create any entitlement to compensation, reward, or employment.

Safe harbour for good-faith research

We will not pursue legal action against researchers who act in good faith, follow this policy, avoid harm to users or systems, and report vulnerabilities responsibly.

This safe harbour does not apply to actions that are malicious, destructive, unlawful, privacy-invasive, or outside the scope of this policy.

Handling accidentally exposed sensitive data

If your research accidentally exposes personal data, confidential information, API keys, tokens, documents, prompts, model responses, or other sensitive material, stop immediately and report the issue.

Do not copy, store, share, or further access the data.