Skip to main content
Audact
See the offer

Coordinated vulnerability disclosure

Last updated: 21 August 2026

Audact welcomes reports from independent security researchers. If you believe you have found a security issue in our platform, our website or our public artefacts, please tell us confidentially before you tell anyone else, and this page says what we will do in return.

1. How to report

Email security@audact.ai. If you would rather encrypt, ask us for our PGP public key in the first message and we will send it; the security contact itself is published at /.well-known/security.txt under RFC 9116.

  • A reproducible proof of concept, or clear steps to reproduce.
  • The affected version, endpoint or URL.
  • What you believe the impact is, and roughly how you got there.
  • Contact details, and whether you want to be named if we publish an acknowledgement.

2. What happens after you report

These are the times we hold ourselves to. If we are going to miss one, you will hear that from us rather than find out by waiting.

  • Within 48 hours. We acknowledge the report and tell you who is handling it.
  • Within 5 working days. We come back with a first assessment: whether we can reproduce it, and how we are rating the severity.
  • During remediation. We keep you updated at a cadence we agree with you, rather than going quiet.
  • Target 90 days, negotiable. The period we ask for before public disclosure. If a fix takes longer, we will say why rather than let the clock run out silently.

3. Safe harbour

Audact will not pursue legal action against researchers who act in good faith, avoid privacy violations, do not exfiltrate customer data, and give us a reasonable time to remediate before public disclosure.

Acting in good faith means: stopping as soon as you have confirmed an issue rather than going deeper, not degrading service for anyone else, and not accessing, modifying or keeping data that is not yours. If you are unsure whether something is in scope, ask first. We would rather answer a question than argue about a boundary afterwards.

4. Recognition

There is no monetary bug bounty today. A qualifying report earns a named acknowledgement, with your consent and in the form you prefer, and we will confirm the finding in writing if you need something for a portfolio or a CVE request.

If that changes, it will be announced on this page with the date it takes effect.

5. Contact

security@audact.ai for anything on this page. For questions about the security architecture, the sub-processor matrix or the data processing agreement, the security page has them; for procurement, the Trust Center does.

Related