Disclosure policy
If you believe you have found a security vulnerability, please report it to security@alltus.com with enough detail for us to reproduce it — a description of the issue, the steps to reproduce it, and the potential impact.
We ask that you give us a reasonable amount of time to resolve the issue before disclosing it publicly, and that you avoid any action that would compromise the security, availability, or integrity of the service or the data it holds.
Confidentiality
We treat every report as confidential, and we will not disclose your identity as the reporting researcher without your consent.
We may share the minimum information necessary with third parties — such as our hosting providers — where that is needed to investigate and resolve the vulnerability.
Exclusions
This policy does not cover activity that is illegal or that violates our terms of service. The following are specifically out of scope:
- Denial-of-service attacks or any testing that degrades service availability
- Spam, phishing, or social engineering of our staff, customers, or their residents
- Physical attacks against our offices or the offices of our customers
- Any activity that damages, destroys, or exfiltrates data
Alltus reserves the right to take legal action in response to unauthorized or damaging activity.
Contact
For feedback, questions, or suggestions about this policy, contact security@alltus.com.