Responsible Disclosure Policy

Fortress Information Security (FIS) is committed to ensuring the security and privacy of our customers' data. We recognize the important role that security researchers and other individuals play in helping us identify potential vulnerabilities in our software and systems. We welcome responsible disclosure of any vulnerabilities that are discovered on our in-scope systems, and we have established the following policy to ensure that such disclosures are handled in a timely and effective manner.

This is not authorization to perform any vulnerability assessments or penetration tests on our products. This policy is provided for guests and researchers who, in the course of their normal work, incidentally, discover vulnerabilities in one of our products.

Reporting a Vulnerability

If you believe you have identified a potential security vulnerability in our products or services, we encourage you to share your findings with us as soon as possible. To do so, please email us at responsibledisclosure@fortressinfosec.com with the following information:

• A detailed description of the vulnerability, including the steps required to reproduce it
• Any related technical documentation or proof-of-concept code that can help us understand and validate the vulnerability
• Your contact information (at least your name and email address)

We will work to validate the vulnerability as quickly as possible. We may contact you for additional information or clarification as needed.

Responsible Disclosure

We are committed to treating all reports of potential vulnerabilities with the seriousness and urgency they deserve. To that end, we ask that you observe the following guidelines when disclosing a vulnerability to us:

• Do not share any information about the vulnerability with anyone other than our security team, unless otherwise required by law.
• Do not attempt to exploit the vulnerability.
• Do not perform any action that could potentially cause harm to our company, our customers, or our systems.

Our Commitment

If we confirm the existence of a vulnerability, we will work to address the issue as quickly as possible. In appropriate circumstances, and if you follow this policy and law, we will credit you for your discovery if you wish for us to do so. We may also invite you to participate in our responsible disclosure program, which includes opportunities to provide feedback on our security practices and receive updates on our security improvements.

Scope

This policy applies to all products and services offered by our company.

Contact Information

To report a vulnerability, please email responsibledisclosure@fortressinfosec.com