Security Disclosure Policy

Scope

This policy covers intelligence.toucan.international and any API we make available. It does not cover services run by third parties, such as our hosting, database, payment and AI providers.

How to report

Email enquiries@toucan.international with a description of the issue, the steps to reproduce it, and what you think its impact is. Please write in English.

What we ask of you

• Access only the minimum data needed to show the issue, and do not view, change or keep other customers' data.
• Do not run denial-of-service tests, social engineering, or automated scans that degrade the Service.
• Give us a reasonable time to fix the issue before you tell anyone else about it.

What you can expect from us

• We acknowledge your report within 5 working days.
• We tell you our assessment and what we plan to do within 10 working days.
• We will not take legal action against you for research carried out in good faith and within this policy.
• We credit you publicly if you would like us to. We do not pay bounties.

Out of scope

• Automated scanner output with no demonstrated impact
• Missing best-practice headers or settings with no working exploit
• Issues that need physical access to a user's device
• Vulnerabilities in third-party services