Security

We take the security of your data seriously. If you have found a problem, we want to hear about it.

Reporting a vulnerability

Email [email protected]. This is the right address for anything security related, and it is the fastest way to reach us.

Please include, as far as you can:

You do not need to have a full exploit. A clear description of something that looks wrong is useful on its own.

We do not run a bug bounty and we do not pay for vulnerability reports. Please do not send a report expecting payment for it.

We are a small team. Reporting something responsibly, and testing responsibly while you look for it, is what makes this work for both of us.

Tell us first, and give us a reasonable amount of time to fix the problem before you discuss it publicly.
Test against your own account and your own data only. Do not access, change, or keep anyone else’s.
Go easy on our systems. No high volume automated scanning, no load testing, nothing designed to degrade the service for our customers.
Do not go further into a flaw than you need to in order to show that it is real.
No phishing, no social engineering of our team or our customers, and no physical attempts against anyone.

We will not pursue legal action against anyone who follows the above and acts in good faith.

Encrypted in transit. Every connection to Pombo uses HTTPS, and we tell browsers to refuse anything else.
Encrypted at rest. The data we store for you is encrypted on disk.
Least privilege. Pombo personnel get the minimum access they need to do their job, and no more.
Industry best practices. We follow accepted standards for how the platform is built, deployed, and run.
Monitored and reviewed. We watch the platform continuously and keep improving our security posture.

Passwords are never stored in readable form. What we collect and why is set out in our Privacy Policy.