1. Security approach
Tymivo applies technical and organisational safeguards appropriate to the nature of the service and information involved. Measures may include access controls, least-privilege administration, encryption in transit, secure configuration, audit logging, monitoring, backup controls and restricted production access.
2. Shared responsibility
Enterprise customers are responsible for user access, identity-provider configuration, authorised integrations, lawful data entry, device security and promptly removing access that is no longer required.
3. Reporting a vulnerability
Send a concise report to [email protected] with the subject “Security report”. Include the affected URL or service, reproduction steps, expected impact and a safe way to contact you. Do not include unrelated personal data.
4. Responsible testing
Do not access another person’s data, disrupt availability, use destructive testing, perform denial-of-service activity, send spam, persist after demonstrating an issue, or publicly disclose an unresolved vulnerability. Stop testing if you encounter sensitive information and report it immediately.
5. Response
We aim to acknowledge credible reports promptly, assess severity, preserve relevant evidence and communicate remediation status where appropriate. This page does not create a bug-bounty programme or promise payment.
6. Security enquiries
Enterprise security questionnaires and architecture information may be provided during procurement under appropriate confidentiality terms.