Responsible Disclosure Policy
aisy welcomes the security research community to help us keep our platform safe. This policy explains how to report a vulnerability to us, what you can expect in return, and the rules that keep everyone protected.
Scope
This policy covers:
- The aisy platform (SaaS application accessible at app.aisy.ai)
- aisy APIs and integration endpoints
- aisy infrastructure and cloud environment
Background
aisy is committed to security excellence and actively welcomes collaboration with the security research community. We recognise that responsible researchers play a vital role in helping organisations identify and fix vulnerabilities before they can be exploited. We view security researchers as partners in our mission to deliver secure, trustworthy products to our customers. All good-faith security researchers are encouraged to report vulnerabilities to us using the designated channels outlined in this policy.
Legal Posture
aisy commits not to pursue legal action against security researchers who report vulnerabilities in good faith, provided they:
- Test and access systems only as necessary to verify the vulnerability, without intentionally damaging or corrupting data
- Remain within the scope of testing (as defined in the Scope of Testing section below)
- Do not intentionally disrupt services or negatively impact customers using the aisy platform
- Adhere to all applicable laws and regulations in their jurisdiction
- Do not publicly disclose the vulnerability without prior written consent from aisy, except as required by law or after a mutually agreed disclosure timeframe has elapsed
This protection applies only to individuals acting in good faith and in compliance with this policy. Violations of these terms may result in legal action.
Vulnerability Reporting
How to Report
Security vulnerabilities must be reported to aisy via email to security@aisy.ai. Reports should not be submitted through public channels such as social media, support tickets, or public issue trackers.
What to Include
Vulnerability reports should include:
- A clear and concise description of the vulnerability
- Step-by-step instructions to reproduce the vulnerability
- The potential impact of the vulnerability (e.g., unauthorised access, data disclosure, denial of service)
- Your contact information (email address and optional phone number)
- Any proof-of-concept code or evidence (if applicable)
Acknowledgement
aisy will acknowledge receipt of your vulnerability report within 5 business days. If you do not receive acknowledgement within this timeframe, please follow up by sending a reminder email.
Confidentiality
All vulnerability reports are treated as confidential. Do not share details of the reported vulnerability with any third party without prior written consent from aisy. aisy will not publicly disclose the vulnerability, researcher's identity, or any details of the vulnerability without mutual written agreement on a specific disclosure date.
Investigation Timeline
aisy will investigate confirmed vulnerabilities promptly. We aim to provide an initial assessment within 10 business days and a remediation timeline within 20 business days. Complex vulnerabilities may require additional time, and we will communicate any delays to the researcher.
Responsible Disclosure Guidelines
Researchers Should
- Report vulnerabilities only through the designated security@aisy.ai email address
- Provide clear, detailed descriptions and proof of the vulnerability
- Give aisy reasonable time to investigate and remediate before public disclosure
- Treat aisy information as confidential until the mutually agreed disclosure date
- Act in good faith and refrain from accessing data unnecessarily
- Avoid disrupting services or affecting customer data
Researchers Should Not
- Exploit vulnerabilities to access sensitive data beyond proof of vulnerability
- Publicly disclose vulnerabilities without prior written consent from aisy
- Attempt to extort, blackmail, or demand payment for withholding disclosure
- Test or access out-of-scope systems (third-party services, physical security, etc.)
- Engage in denial-of-service attacks or intentional service disruption
- Disrupt other users' access to the aisy platform
- Use automation tools excessively, sending a high volume of traffic to aisy's networks
Scope of Testing
To ensure responsible disclosure and reduce unnecessary disruption, the following scope guidelines apply to security testing:
In-Scope
- The aisy web application at www.aisy.ai (and subdomains)
- aisy APIs and integration endpoints (REST API, webhooks, etc.)
- aisy cloud infrastructure and platform services hosted on AWS
- Any security-related components of the aisy system
Out-of-Scope
- Social engineering or phishing attempts targeting aisy employees
- Physical security testing or unauthorised access to aisy facilities
- Denial-of-Service (DoS) or Distributed Denial-of-Service (DDoS) attacks
- Third-party services or infrastructure (AWS infrastructure not owned by aisy, external APIs, hosting providers)
- aisy employee personal accounts or non-business systems
- Testing systems without explicit written authorisation from aisy
Enforcement
Researchers who violate the terms of this policy (by engaging in malicious activity, attempting extortion, publicly disclosing vulnerabilities prematurely, or accessing out-of-scope systems) may be reported to law enforcement and pursued through legal channels.
Found something?
Email security@aisy.ai with the details. We'll take it from there.