Security

Responsible Disclosure Policy

If you believe you have found a security vulnerability in Idntfy, we want to hear about it. This policy explains how to report it, what you may and may not do while looking, and what we commit to in return.

In effect since

How to report a vulnerability

Send your report by email to:

security@idntfy.eu

Please include:

  • the address, page or feature that is affected;
  • the steps to reproduce the problem;
  • what an attacker could do with it;
  • whether, and under what name, you would like to be credited.

We read reports in English and Dutch.

Scope

This policy covers the systems we operate:

  • our website (idntfy.eu, ydntfy.com)
  • the Idntfy platform: the administration application, its sign-in service and its API (app.idntfy.eu, auth.idntfy.eu, api.idntfy.eu)
  • the public eIFU portals we host for our customers, including portals on a customer’s own domain (*.hcp.idntfy.eu, *.patient.idntfy.eu)

It does not cover the services of our providers, such as our cloud hosting and email providers. Report a problem in their systems to them, under their own policies.

Rules while you look

To stay within this policy:

  • Use only accounts that you own or that you have permission to use.
  • Do not access, change, delete or keep data that is not yours. If you come across personal data or a customer’s content, stop, do not copy it, and tell us in your report.
  • Do no more than you need to show the problem.
  • Do not carry out denial-of-service attacks, load tests or anything else that degrades the service for others.
  • Do not use social engineering or phishing against our staff or customers, and do not attack our premises or equipment.
  • Stop and report as soon as you find a problem. Do not use it to go further into our systems.
  • Keep the details confidential until the problem is fixed, as described under Disclosure below.

What we commit to

  • We acknowledge your report within 3 business days.
  • We tell you whether we can reproduce the problem, and keep you informed of our progress until it is resolved.
  • We fix or mitigate a vulnerability that affects production within 7 days if it is critical, 30 days if it is high and 90 days if it is medium, counted from when we know of it.
  • If you wish, we credit you by name once the problem is fixed.

Legal safe harbour

We will not take legal action against you, or ask the authorities to act against you, for research that follows this policy in good faith. Our Terms of Service say the same to our customers: good-faith security research that is reported to us in line with this policy is not a breach of their acceptable-use rules. This policy cannot authorise access to systems that are not ours.

Disclosure

Give us reasonable time to fix the problem before you make it public: 90 days from your report, unless we agree a different date with you. Tell us before you publish, so that we can agree what is disclosed.

No bug bounty

We do not run a bug bounty programme and do not pay for reports.

Machine-readable contact

Our security contact is also published in the format defined in RFC 9116, at:

/.well-known/security.txt