Security and Responsible Disclosure

1. Security contact and scope

If you believe you have found a security weakness affecting Ownsera, submit a report through /legal/contact using the Security category or contact ops@ownseraiq.com. Include the affected URL or feature, a concise description, and non-destructive reproduction steps. Do not include credentials, unnecessary personal information, bulk customer data, or exploit material in a public post.

Ownsera will review good-faith reports, prioritize issues by risk, and communicate through the contact details supplied where appropriate. We do not guarantee a fixed response or remediation time unless separately agreed. This Policy does not create a bug-bounty payment, employment, or consulting relationship.

2. Authorized responsible testing

You may conduct limited, good-faith testing of your own Ownsera account using synthetic data to identify and privately report a vulnerability, provided you remain within these conditions and applicable law. Do not access, change, copy, retain, or delete another person's information; escalate privileges, access administrative features, or cross account or organization boundaries without separate written authorization; disrupt availability; social engineer staff; test physical security; introduce malware; extort payment; or attack third-party infrastructure. Stop immediately if you encounter another person's data and report the minimum facts necessary to identify the issue.

Testing must not evade payment or use a vulnerability for any purpose other than the authorized report. Do not use automated scans that could degrade the Service. Obtain written authorization for broader testing. We will not pursue a claim solely for a good-faith activity that stays within this Policy; we cannot authorize a third party's systems, waive another person's rights, or bind a regulator or law-enforcement agency. Ask for clarification if scope is uncertain.

3. Confidentiality and transparency

Allow a reasonable opportunity for coordinated remediation before publishing technical details that would expose users. This request does not prohibit legally protected disclosures, regulator communications, lawful criticism, or reporting that applicable law protects. No prior approval or notice is required for those protected activities.

We describe implemented security measures and independent certifications only when they have been verified and remain current. A cloud provider's certification is not automatically a certification of Ownsera. Security measures reduce risk but cannot guarantee that every intrusion, error, or misuse will be prevented. Applicable notification and remediation duties are not waived.

Ownsera and its stakeholders use commercially reasonable efforts and industry-standard technical, administrative, and physical safeguards to prevent unauthorized access to, or accidental disclosure of, personally identifiable information. While we apply these safeguards to protect your information, no transmission or storage system can be guaranteed completely immune from unauthorized third-party interference.