Autm

Keeping customer data safe matters to us. If you believe you have found a security vulnerability in Autm, we want to hear from you and will work with you to understand and fix it.

Reporting a vulnerability

Email security@autm.ai with enough detail for us to reproduce the issue. You don't need an Autm account to report a vulnerability.

Please include:

• the affected website, page, feature or integration;

• the steps needed to reproduce the issue;

• the impact as you understand it; and

• any proof of concept, such as screenshots or a short script.

Please do not include customer data or personal data in your report.

What to expect from us

• We will acknowledge your report within 3 business days.

• We will give you an update on our assessment within 30 days, and further updates at least every 30 days until the issue is resolved.

• We will tell you when the issue has been fixed, and we will coordinate any public disclosure with you.

• If a vulnerability affects customer data, we notify affected customers without undue delay, as set out in our Data Processing Agreement.

Scope

This policy covers:

• autm.ai and app.autm.ai;

• the Autm application and its APIs; and

• the Autm integration for Slack.

Third-party services that connect to Autm, such as Google, Microsoft, Slack, Zoom, and Stripe, are out of scope. Please report issues in those services to the relevant vendor.

What we ask of you

• Give us a reasonable amount of time to fix the issue before you share details publicly.

• Do not access, change or delete data that belongs to someone else. Use your own test account where you can.

• If you come across customer data, stop, do not keep a copy, and tell us straight away.

• Do not disrupt the service, for example through denial-of-service attacks, spam or high-volume automated scanning.

• Do not use social engineering, phishing or physical attacks against Autm staff, customers or premises.

Safe harbour

If you act in good faith and follow this policy, we will treat your research as authorised. We will not take legal action against you for it, and we will not support legal action by others. If a third party takes action against you for research carried out in line with this policy, we will make it known that you acted in good faith.

Recognition

We do not currently run a paid bug bounty. If a valid report leads to a fix, we will thank you and, if you would like it, credit you publicly.

Other security and privacy questions

For general support, privacy questions or data requests, email support@autm.ai. You can also read our Privacy Policy and Data Retention Policy.