Kreditz Responsible Disclosure Policy

Kreditz considers research conducted under this policy to be authorised. We will not pursue civil or criminal legal action against you, nor support such action by third parties, provided that you:

• act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services;act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services;

• stay within the scope and rules of this policy;

• communicate with us only through the channel described under "How to report a vulnerability";

• keep the vulnerability confidential until we have resolved it.
  

This safe harbour applies only to research conducted under this policy. It does not cover security testing commissioned by Kreditz customers, which requires a separate written authorisation (see "Security testing by Kreditz customers").

The following are not treated as vulnerabilities under this policy unless you can show a concrete security impact:

• missing security headers or cookie flags;
• email configuration findings, such as SPF, DKIM or DMARC records;
• clickjacking on pages without sensitive actions;
• self-XSS, and issues that require physical access to a victim's device;
• disclosure of software versions or banners;
• unverified output from automated scanners;
• missing rate limiting on non-sensitive functions.
  

When researching our services, you must not:

• perform phishing or other social engineering against Kreditz employees, contractors or customers;
• perform denial-of-service attacks, or any other activity that degrades or disrupts our services, including high-volume automated scanning;
• use or attempt to access any account other than accounts you have created yourself or are explicitly authorised to use. Attempts to access other customers' accounts or data are prohibited;
• access, download or modify more data than is necessary to demonstrate a vulnerability;
• install persistent access, backdoors or malware;
• carry out physical attacks against Kreditz premises, or attacks against our cloud infrastructure providers.

Our sandbox is used by our customers to test their integrations and may contain real personal data. If you encounter personal data or financial data in any in-scope service, stop immediately, do not copy or keep it, and report it to us. Delete any data you obtained during your research once you have reported the vulnerability.

Report vulnerabilities by email to security@kreditz.com. Please include:

• a description of the vulnerability;
• steps to reproduce it (proof of concept);
• the impact of the vulnerability.

Sensitive data: We do not currently use PGP encryption for email. Do not include personal data or real financial data in your email. If such data is needed to demonstrate the vulnerability, redact it or ask us for a secure transfer method in your first message.

• Acknowledgement: We aim to acknowledge your report within 3 business days.
• Assessment: We assess the report and keep you informed of our progress.
• Remediation: We aim to resolve critical vulnerabilities within 30 business days.
• Disclosure: Please keep the vulnerability confidential until we have resolved it. If you want to publish your findings, agree the timing with us first.

We do not currently offer a bug bounty programme or a public hall of fame, but we appreciate every report that helps us protect our customers and their end users.

Kreditz customers who want to perform their own security testing of the Vista service should contact their Kreditz account contact or security@kreditz.com. Such testing requires a signed written authorisation and follows separate rules of engagement. It is not covered by this policy.

We may update this policy at any time. The current version is published at https://kreditz.com/responsible-disclosure-policy.

Last updated: 30th of October 2026