Security

Report Security Vulnerabilities

The security of our products and of our customers' data is our highest priority. If you have discovered a potential vulnerability in one of our services, please report it to us. We review every report and work on a resolution.

Scope

This policy applies to all products, services, websites, and applications operated by fino data services GmbH - regardless of the brand or domain under which they are offered.

Out of Scope

The following are not covered by this policy:

Third-party services and infrastructure that we use but do not operate ourselves
Products and websites belonging to partners or affiliated companies not owned by fino data services GmbH
Attacks targeting the availability of our systems (e.g. denial-of-service)
Social engineering against our employees or customers, and physical attacks against our premises

If you are unsure whether a system falls within scope, please contact us beforehand.

How to report a vulnerability

Send your report to [email protected]. To help us assess and reproduce your finding quickly, the following details are helpful:

A description of the vulnerability and the affected service, URL or endpoint.
Reproducible steps or a proof of concept that allow the issue to be reproduced.
The potential impact, as far as you can assess it.
Your contact details for follow-up questions.

If you would like to send sensitive details encrypted, use our PGP key. Alternatively, mention it in your first message and we will provide an encrypted channel.

[email protected]

What we ask of you

For us to treat your work as good-faith security research, the following binding rules apply:

Access only the data that is strictly necessary to demonstrate the vulnerability. You must not delete or modify data belonging to others.
Respect the privacy of third parties. You must not share any personal data you come across and must not store it longer than necessary for the proof.
Denial-of-service attacks, spam and social engineering against our employees, customers or partners are strictly prohibited.
Do not exploit a vulnerability beyond what is necessary to demonstrate it. In particular, you must not exfiltrate or modify data or establish persistent access.
Give us reasonable time to remediate. Publish details only after prior coordination with us. (Responsible disclosure)

How we handle your report

We confirm receipt of your report, usually within a business day.
We review the finding and get in touch if we have follow-up questions.
We keep you informed about the processing status and the remediation.

No bug bounty program

We currently do not operate a bug bounty program and do not pay monetary rewards for reports. Nevertheless, we appreciate every legitimate report and handle it with the same care.

Safe Harbor

If you act in good faith and comply with this policy, we consider your security research to be authorized. In that case, we will not initiate legal action against you and will not file a criminal complaint regarding your research.

Should a third party initiate legal action against you because you complied with this policy, we will, upon request, make clear that your actions were coordinated with us. If you are unsure whether a particular action is covered by this policy, please ask us in advance.

Found a security vulnerability?

Write to our security team. We usually confirm receipt within a few business days.

[email protected]