Security policy

Reporting a vulnerability

Email support@dataanonymiser.com with “Security” in the subject. Please include:

• the product and version affected;
• steps to reproduce, or a proof of concept;
• what an attacker could achieve.

Please use made-up data in your report, never real personal information, and do not disclose the issue publicly until we have fixed it or agreed a date with you.

What happens next

• We confirm receipt within 3 business days.
• We give you an initial assessment within 7 days, and keep you updated after that.
• We agree a disclosure date with you, and credit you if you wish.

Our targets for releasing a fix, by severity:

Scope

The DataAnonymiser desktop app, mobile apps and browser extension, the Enterprise components, this website and our licence server. We treat these as the most serious:

• anything that lets text, images or results leave the device;
• bypassing the signature checks on model packs or app updates;
• access to another person's account, licence or devices.

Out of scope: denial-of-service, social engineering, physical attacks, issues that require an already-compromised device, and third-party services we use (such as our payment provider), which you should report to them.

Good-faith research

We will not take legal action against research that follows this policy: test only against your own accounts and devices, do not access, change or keep other people's data, stop and tell us if you come across personal data, and do not degrade the service for others.