Book a demo
Account Verification
Advisory Services
Book a demo

Kreditz Responsible Disclosure Policy

Jump to a topic
Safe Harbor
Scope
Out of Scope
Reporting a Vulnerability
Our Response
Rules of Engagement

Safe Harbor

Kreditz considers research conducted under this policy to be authorized. We will not pursue civil or criminal legal action against you, nor support such action by third parties, provided that you:

  • Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services.
  • Operate within the scope of this policy.
  • Communicate with us exclusively through the official channels defined below.
  • Keep the vulnerability confidential until we have resolved the issue.

 

Scope

The following services are in scope for this policy:

Out of Scope

Out of Scope:

  • Marketing website (www.kreditz.com) and other static content pages.
  • Third-party providers or services integrated with Kreditz.

 

Reporting a Vulnerability

If you believe you have discovered a vulnerability, please report it to security@kreditz.com.

 

What to include:

  • Description of the vulnerability.
  • Steps to reproduce the issue (Proof of Concept).
  • The impact of the vulnerability.


Important Note on Sensitive Data: As we do not currently use PGP encryption for email, please do not include sensitive Personal Identifiable Information (PII) or real financial data in the body of your email. If sharing such data is necessary to prove the vulnerability, please redact it or ask us for a secure transfer method in your initial report.

 

Our Response

Acknowledgement: We aim to acknowledge receipt of your report within 72 hours.

Remediation: We aim to resolve critical security issues within 30 business days. We will keep you updated on our progress.

Recognition: We sincerely appreciate your efforts in helping us secure our platform. While we do not currently offer a bug bounty program or a public Hall of Fame, we value your contribution to the security community.

 



Rules of Engagement

To ensure safety and compliance, the following are strictly prohibited:

  • Social Engineering: Phishing or social engineering of Kreditz employees, contractors, or customers.
  • Denial of Service: Any attack intended to degrade or disrupt service (DoS/DDoS).
  • Data Privacy: Accessing, downloading, or modifying data that does not belong to you. If you encounter PII (Personally Identifiable Information) or financial data, stop immediately and report the issue.
  • Physical Attacks: Attacks against Kreditz physical offices or our cloud infrastructure providers.

 

Thank you for helping keep Kreditz and our customers safe.

Talk To Us

Ready to upgrade your credit decisioning process? Let’s explore how we can work together.

Message