BejelentkezésBemutató kérése
Security

Report a security issue.

If you think you have found a weakness in adverant.ai or in Adverant Nexus, we want to hear from you. Tell us privately, give us time to fix it, and we will work with you in good faith.

security@adverant.ai Trust centre

Also published at /.well-known/security.txt

What we promise

48 hoursto tell you a person has your report
7 daysto give you our first assessment
Updatesas we fix it, and credit if you want it

We fix the most serious issues first. We will tell you when the fix is out and agree with you when the details can be shared.

How to report

Email security@adverant.ai. Please include:

  • what you found and where (the URL, product area or component);
  • the steps to reproduce it, with any proof-of-concept code or screenshots;
  • what an attacker could do with it, as you see it;
  • how to reach you, and whether you would like to be credited.

Write in English if you can. One clear report is more useful than several short ones. Please do not include personal data you came across; describe it instead.

What is in scope

  • adverant.ai and its subdomains run by Adverant;
  • Adverant Nexus as we run it in our EU cloud, including the AI switchboard, sign-in, and the open record verifier;
  • Nexus software, installers and update packages you have a licence to run.

Out of scope: attacks on our people (phishing, social engineering), physical attacks, denial of service, findings that need an already compromised device, and reports from automated scanners without a demonstrated impact. A customer's own installation belongs to that customer; please report issues there to them as well as to us.

Testing rules

  • Use only accounts and data that are yours, or that you were given for testing.
  • Do the least needed to prove the issue. Stop and tell us as soon as you reach other people's data.
  • Do not change or delete data, degrade service, or keep access longer than needed.
  • Keep the details private until we have agreed a disclosure date.

Safe harbour

If you act in good faith and follow these rules, we will treat your research as authorised. We will not take legal action against you or report you to the authorities for it, and if someone else does, we will make it clear that you acted with our permission. This does not cover actions that break the law in ways these rules cannot authorise.

Disclosure

We prefer to publish details after a fix is available to everyone who needs it. We will agree the timing with you, and we will not ask you to stay silent for longer than it takes to protect our customers. If we disagree, we will tell you why.

If you are a customer

Report suspected incidents through the security contact in your agreement or through support inside Nexus, so we can follow your incident plan. For how we protect data and the rules we map, visit the trust centre.