Vulnerability Disclosure Policy
Datafalk Inc. · Last updated: 28 October 2026 · Effective date: 28 October 2026
1. Our commitment
Datafalk Inc. ("Datafalk") takes the security of its Services and of the data entrusted to it seriously. We welcome reports from security researchers and users who discover vulnerabilities, and we commit to working with them in good faith to resolve the issues reported.
2. Scope
This Policy covers the systems operated by or for Datafalk and under its control: datafalk.com, app.datafalk.com, atlas.datafalk.com, demo.datafalk.com, the Datafalk APIs and the servers that serve them. It does not cover the systems of our service providers (hosting, payment, email), which have their own disclosure programmes, nor the systems of our customers, nor any third-party system reached through a Datafalk domain. Where you are unsure whether a system is in scope, ask security@datafalk.com before testing.
3. Rules of engagement
Research conducted under this Policy must: (a) be limited to what is necessary to demonstrate the vulnerability, and stop as soon as it is confirmed; (b) not access, modify, delete or exfiltrate data that does not belong to you, and, if personal or confidential data is encountered, stop immediately, not retain it, and tell us; (c) not degrade the availability of the Services, including by denial-of-service testing, automated scanning at high volume or resource exhaustion; (d) not involve social engineering, phishing, physical intrusion or attacks on Datafalk personnel; (e) not exploit a vulnerability beyond demonstration, and not pivot to other systems; (f) comply with applicable law.
4. How to report
Send your report to security@datafalk.com. Please include a description of the vulnerability, the affected system or URL, the steps to reproduce it, its potential impact, and a safe proof of concept. Do not include personal data, credentials or confidential customer content. If you need an encrypted channel, ask us first and we will provide one.
5. What we commit to
We acknowledge receipt within five business days, keep you informed of our progress, work to remediate confirmed vulnerabilities as quickly as their severity requires, and tell you when the issue is resolved. With your agreement, we credit researchers who report valid vulnerabilities. We do not operate a paid bug bounty programme.
6. Coordinated disclosure
We ask that you do not disclose a vulnerability publicly before we have resolved it or before ninety days from your report, whichever comes first, unless we agree a different timetable together. If the issue is not resolved within ninety days, we discuss a reasonable disclosure plan with you; we will not ask you to delay disclosure indefinitely. Any disclosure must protect personal data, confidential information and third-party systems.
7. Safe harbour
Datafalk will not initiate legal action against you, and will not voluntarily refer you to the authorities, for security research conducted in good faith in compliance with this Policy. To the extent your research complies with this Policy, Datafalk considers it authorised with respect to the systems under its control, including for the purposes of the Terms of Use, of the United States Computer Fraud and Abuse Act and of comparable laws, and waives any claim it may have against you for circumvention of the technical measures protecting those systems under the Digital Millennium Copyright Act. Datafalk cannot authorise access to systems it does not control, waive the rights of third parties or bind public authorities. If a third party brings legal action against you for research conducted in compliance with this Policy, we will make it known that your actions were authorised by Datafalk. A minor inadvertent departure from this Policy, promptly reported and remedied, is reviewed in good faith rather than automatically cancelling this commitment. Nothing in this Policy prevents a report or cooperation required of Datafalk by applicable law. This safe harbour does not apply to research that breaches this Policy or to conduct that is unlawful independently of this Policy.
8. Contact
security@datafalk.com. Datafalk Inc., 1272 S Governors Ave, Ste C, POB 1017, Dover, DE 19904, United States of America. This Policy is referenced in the security.txt file published at /.well-known/security.txt on each of our domains.