This policy sets out how Syott Limited ("Syott") handles and discloses security issues affecting our website, our products or the services we rely on, whether someone reports an issue to us or we find it ourselves. To report a vulnerability, follow our Vulnerability Disclosure Policy.
Our principles
- Protect people first. Our priority is to fix or contain an issue before its details become public.
- Tell those affected. If an issue puts customers or their data at risk, we tell the affected customers directly and without undue delay.
- Work with reporters. We keep the person who reported an issue informed and agree the timing of any public disclosure with them.
- Be accurate. When we publish information about an issue, we describe it plainly, without hiding or overstating its impact.
- Give credit. We credit reporters publicly if they would like us to.
Timelines
We acknowledge reports within 3 business days and keep reporters updated until the issue is resolved.
By default, we ask reporters to wait 90 days from their report, or until a fix is available if that is sooner, before publishing details. We may agree to earlier publication if an issue is being actively exploited, or agree a later date with the reporter if a fix needs more time and we're making clear progress.
Personal data breaches
If a security issue leads to a personal data breach, we follow our legal obligations. For personal data we control, we notify the Data Protection Commission within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to people, and we inform the people affected where the risk to them is high. For data we process on behalf of customers, we notify the customers concerned without undue delay so that they can meet their own obligations.
Issues we find in other products
If we find a vulnerability in software or a service made by someone else, we report it privately to the vendor and give them a reasonable time to fix it, normally 90 days, before any details are published. If a vendor can't be reached or doesn't respond, we may ask a national authority, such as Ireland's National Cyber Security Centre, to help coordinate disclosure.
Safe harbour
If you research and report a vulnerability in good faith and in line with our Vulnerability Disclosure Policy, we consider your research authorised. We won't take legal action against you or ask law enforcement to investigate you because of it. If someone else takes action against you over research that followed our policy, we'll make it known that your research was authorised by us.
This safe harbour doesn't cover accessing or keeping more data than you need to demonstrate an issue, harming our users or services, or using an issue to demand payment. We can't authorise research on systems we don't own, such as our service providers' platforms.
Contact
Questions about this policy: disclosure@syott.co. Security reports: security@syott.co. Our security contact details are also published at /.well-known/security.txt.