Responsible Disclosure Policy

1. Purpose

Acceldata is committed to the security of its products, platforms, and customer data. This policy defines how security researchers, customers, and members of the public can report suspected vulnerabilities to Acceldata, and how we respond. Our vulnerability disclosure and bug bounty programme is operated in partnership with HackerOne, which serves as our managed intake, triage, and reward platform.

2. Scope

This policy applies to internet-facing systems and products owned or operated by Acceldata, including:

• Acceldata production platforms and their supporting APIs
• acceldata.io and Acceldata-controlled subdomains
• Acceldata-published client applications, agents, and SDKs

The authoritative in-scope and out-of-scope asset list is published on our HackerOne programme page at hackerone.com/acceldata and takes precedence where it differs from the summary below.

Out of scope:

• Third-party services, platforms, or vendor-hosted subdomains not under Acceldata's control
• Denial-of-service, volumetric, stress, or load testing
• Social engineering, phishing, or physical attacks against Acceldata personnel or facilities
• Unauthenticated scanner output with no demonstrated impact
• Missing security headers, cookie flags, mail authentication records, or TLS configuration findings without a working exploit path
• Self-XSS, clickjacking on non-sensitive pages, or issues requiring an outdated or unsupported browser
• Vulnerabilities in customer-managed deployments where the root cause is the customer's own configuration

3. How to Report

Submit reports through our HackerOne programme at hackerone.com/acceldata. HackerOne is the required channel for reward eligibility, as it provides secure handling, structured triage, and a tracked communication trail.

Researchers unable to use HackerOne may email security@acceldata.io. Reports received by email are entered into the programme by the Acceldata security team for tracking.

Please include:

• A clear description of the vulnerability and affected asset, URL, or endpoint
• Steps to reproduce, including any proof-of-concept code or requests
• Assessed impact and, if available, a CVSS v3.1 vector
• Environment details (browser, client version, timestamps of testing)
• Your contact details and whether you wish to be publicly acknowledged

Do not include live customer data, credentials, or personal data in your submission beyond what is strictly necessary to demonstrate the issue.

4. Our Commitments

Acceldata, working with HackerOne, will:

• Acknowledge receipt of your report within 3 business days
• Complete initial triage and validation within 10 business days
• Provide status updates at least every 15 business days until resolution
• Remediate confirmed vulnerabilities in line with our severity-based remediation targets (Critical: 7 days; High: 30 days; Medium: 90 days; Low: 180 days)
• Not pursue or support legal action against researchers who act in good faith and in accordance with this policy
• Credit you for the finding, if you wish, once the issue is resolved

Confirmed vulnerabilities are managed through Acceldata's established vulnerability management and remediation processes and, where warranted, escalated through our incident response process. Customer notification obligations are assessed against applicable contractual and regulatory requirements.

5. Rules of Engagement

Participation is governed by this policy, the terms published on our HackerOne programme page, and HackerOne's Code of Conduct and Disclosure Guidelines. When testing, you must:

• Only test against accounts and data you own or are explicitly authorised to access
• Stop testing immediately upon encountering customer data, personal data, or credentials, and report it
• Not access, modify, delete, exfiltrate, or retain any Acceldata or customer data
• Not degrade, disrupt, or interrupt the availability or integrity of Acceldata services
• Not use automated scanning that generates excessive traffic
• Not install backdoors, persist access, or pivot to other systems
• Not attempt to extract, poison, or manipulate models, training data, or system prompts belonging to other tenants

6. Safe Harbour

Acceldata considers security research and vulnerability disclosure conducted in accordance with this policy and our HackerOne programme terms to be authorised, and will not initiate or recommend legal action in respect of it. If a third party initiates legal action against a researcher who has complied with this policy, Acceldata will make it known that the activity was authorised. This safe harbour does not extend to activity that breaches Section 5, or to actions that violate applicable law.

7. Coordinated Disclosure

Do not publicly disclose a reported vulnerability until Acceldata has confirmed remediation, or until 90 days from the date of your report, whichever is earlier. Disclosure requests are managed through HackerOne's coordinated disclosure process and require mutual agreement. We ask that any public write-up exclude Acceldata or customer data.

8. Rewards and Recognition

Acceldata offers monetary rewards for valid, in-scope vulnerability reports that lead to mitigation. Bounty amounts are determined at Acceldata's sole discretion, based on the severity and demonstrated business impact of the finding, in line with the reward table published on our HackerOne programme page. All payments are administered by HackerOne and subject to HackerOne's identity verification, tax, and sanctions-screening requirements.

Rewards are not payable where:

• The report is out of scope, or the asset is not owned or operated by Acceldata
• The issue is a duplicate of a previously submitted report; the first valid submitter as determined by triage is eligible
• The issue was already known to Acceldata through internal testing, penetration testing, or automated scanning prior to the report
• No security impact can be demonstrated, or the finding is theoretical
• The researcher breached Section 5 (Rules of Engagement) or Section 7 (Coordinated Disclosure)
• The researcher is a current or former Acceldata employee or contractor, or is resident in a jurisdiction subject to applicable sanctions or export restrictions

Severity classification is determined by Acceldata using CVSS v3.1 as a baseline, adjusted for exploitability and business context. Acceldata's severity determination is final. Valid reports are additionally recognised through written acknowledgement and, at the researcher's discretion, public credit.

9. Non-Compliance

Activity that falls outside this policy — including unauthorised access, data exfiltration, extortion, or coercive disclosure demands — will be treated as a security incident and may be referred to law enforcement and pursued through all available legal remedies.

10. Policy Review

This policy is reviewed at least annually, and following any material change to Acceldata's products, infrastructure, or regulatory obligations.