Security and responsible disclosure

Reporting a vulnerability

If you believe you have found a security vulnerability in Gallesis, please write to security@gallesis.com. Describe the problem and the steps to reproduce it, and give us a reasonable time to fix it before you make it public.

What you can expect from us

We acknowledge your report within five working days and keep you informed while we work on a fix. We do not run a bug-bounty programme and offer no monetary reward, but we are grateful for every careful report and will credit you by name if you wish.

Safe harbour for good-faith research

We will not take legal action over security research carried out in good faith and in line with this policy. In return we ask that you:

• access only data that belongs to you, never another person's or another business's;
• do not degrade, interrupt or overload the service, and do not run high-volume automated attacks against the live system;
• do not alter or delete data, and stop as soon as you have shown that a problem exists;
• give us a reasonable time to fix the issue before you tell anyone else;
• comply with data-protection law at all times.

Out of scope

Social engineering of our staff or customers, physical attacks, denial-of-service testing and spam are not covered by this policy and are not authorised.

Scope

This policy applies to the websites gallesis.com and app.gallesis.com and to the Gallesis service behind them.