Responsible disclosure

In plain language: test on your own account, do not touch other people's data, tell us at security@intramedial.com, give us time to fix, and we will not pursue you.

2. How to report#

Use the vulnerability report form or email security@intramedial.com. Please do not file public issues or post details before the fix. We do not publish a PGP key today; if you need to send sensitive detail, send a short first message through the form and we will agree a secure channel with you.

You can report anonymously through the form. An anonymous report carries no name or email address, and we do not record your IP address or browser details with it; our hosting provider keeps standard network logs, so use Tor or a trusted VPN if you need stronger anonymity. After sending, you receive a reference and a case key. Only a fingerprint of the case key reaches us, and a follow-up that presents the same reference and case key lets us link it to your first report. We cannot reply to an anonymous reporter, cannot credit one, and assess anonymous reports under the same targets as any other.

Include:

• what you found and its impact, in one or two sentences;
• the exact request, URL or steps to reproduce, using your own workspace;
• the time (UTC) and any request id, agent id or ledger entry id;
• your name or handle for recognition, if you want it, and how to reach you.

Please do not send secrets, full API keys or other people's personal data in the report. The form refuses submissions that contain a full API key or token.

3. Scope#

In scope

• intramedial.com and its sub-domains that we operate: api.intramedial.com (including its regional hosts), mcp.intramedial.com, app.intramedial.com and cdn.intramedial.com;
• the REST API, the MCP server, the dashboard and the assistant (for example prompt injection that reaches another workspace's data or makes the assistant act beyond its read-only role);
• admission, leases, mandates and enforcement points (for example obtaining an admission that policy should refuse, using an expired or revoked lease, escalating a mandate beyond its scope, bypassing dual control on a scope that needs two administrators, or an agent obtaining standing cloud credentials);
• the audit chain, the witnessed ledger and ledger bundles: forging, altering, reordering or removing an entry undetected, a bundle that verifies when it should not, or exposure of a bundle-signing key;
• authentication, session, API-key and DPoP handling, sign-in through Avonao ID, single sign-on and SCIM, and tenancy isolation (one workspace reaching another's data);
• the sealed storage of connection secrets, and the handling of credentials in connectors and adapters;
• region and residency controls (for example data of a workspace appearing in a region it was not placed in);
• our published packages, including the MCP server package and the offline verifier.

Out of scope

• denial-of-service and load testing, volumetric attacks, and automated scanning that generates significant traffic;
• social engineering, phishing, and physical attacks against our people or our providers;
• attacks on third-party services, including Cloudflare, Avonao Billing, Stripe, Resend, Anthropic and Google, or on any system you do not own (report those to the owner);
• findings that need a compromised device or browser, outdated browsers, or missing best-practice headers with no demonstrated impact;
• spam, content-injection without a security effect, and the lack of rate limiting on public pages;
• the fact that labels and free text you submit appear in readable form in records, which is documented behaviour;
• the limits of what a ledger bundle proves, as stated in the Terms and documentation;
• wrong or inaccurate answers from the assistant that do not cross a security boundary;
• anything in the Terms or the Acceptable Use Policy that is a policy rather than a vulnerability;
• reports from automated tools with no demonstrated, working impact.

4. Rules for good-faith research#

• Test only against your own account and data, or data you have explicit permission to use.
• Do not access, modify, keep or disclose other customers' data beyond the minimum needed to show the issue, and stop and tell us at once if you reach it.
• Do not degrade the Service for others, and do not use destructive techniques, such as deleting data or running denial of service.
• Do not use the issue to attack third parties, and do not pivot into internal systems.
• Give us a reasonable time to fix before you disclose. We ask for 90 days from your report, and will agree a shorter or longer period with you if there is good reason.
• Follow the law, and do not ask for payment in exchange for not disclosing.

5. Safe harbor#

If you act in good faith and follow this policy, we will:

• consider your research authorised for the purposes of the Terms and the Acceptable Use Policy, and not suspend your account for it;
• not start, or support, legal action against you for the research, including under computer misuse and anti-circumvention laws; and
• if a third party starts action against you for research that follows this policy, say that it was authorised by us.

This safe harbor covers only our systems. It does not cover third parties, and it does not apply to conduct outside this policy, such as accessing data beyond what is needed or extortion.

6. What to expect from us#

These are targets, not guarantees. We will tell you if we expect to miss one, and why. After the fix we will tell you, and may coordinate publication of an advisory with you. If a vulnerability affects personal data, we handle it under the Data Processing Addendum and the Privacy Policy, including notifying affected customers within 72 hours of becoming aware of a personal data breach.

7. Rewards and recognition#

We do not pay monetary rewards (no bug bounty). We will, if you wish, thank you by name or handle on request in the published advisory or release note for the fix. Tell us in your report how you want to be credited, or that you prefer to stay anonymous. We do not give credit for reports that break this policy.

8. security.txt summary#

9. Contact#

Security reports: the report form or security@intramedial.com. Other matters: support@intramedial.com.

EU notices

• Digital Services Act
• EU Data Act
• EU AI Act
• Right of withdrawal

Receipt practices

• Record Practice Statement
• Verifier Terms
• Key management
• Verifying ledger bundles
• Format versions and long-term verification
• Cryptographic agility and post-quantum status
• If Intramedial stops operating

Program terms

• Startup Program Terms
• Nonprofit Program Terms
• Education Program Terms
• Public Sector Program Terms