Certyze Vulnerability Disclosure Policy

1. Definitions

In this Policy, the following terms have the meanings set out below.

2. Purpose and Scope

This Policy establishes a coordinated framework through which Reporters may identify and disclose Vulnerabilities in the Provider’s systems in a responsible manner. The Provider welcomes good-faith security research conducted in accordance with the terms set out herein.

The following assets are within the scope of this Policy (collectively, the “In-Scope Systems”):

This Policy is effective as of 19 October 2026 and applies to all Vulnerability reports submitted on or after that date.

3. Out-of-Scope Activities and Systems

The following activities and systems fall outside the scope of this Policy. Reports relating to Out-of-Scope items may be closed without further action.

4. Reporting a Vulnerability

Any individual who discovers a Vulnerability in an In-Scope System shall report it promptly to the Provider at legal@thinkdatalabs.com.

Each report must include the following information:

Reporters shall submit findings as soon as practicable after discovery and before any further testing beyond initial confirmation. Incomplete reports may delay assessment; the Provider reserves the right to request additional detail.

5. Reporter Obligations

Each Reporter shall comply with the following obligations when identifying or testing a Vulnerability in any In-Scope System:

6. Provider Response Commitments

The Provider commits to the following response standards for all Vulnerability reports submitted in accordance with this Policy:

6.1 The Provider shall acknowledge receipt of a report within five (5) business days of submission to the designated reporting address.

6.2 The Provider shall provide status updates to the Reporter as appropriate during the assessment and remediation process.

6.3 The Provider shall prioritise remediation based on assessed risk severity.

6.4 Where a report is determined to be a duplicate of a previously reported Vulnerability or falls outside the scope of this Policy, the Provider shall notify the Reporter of that determination.

7. Coordinated Disclosure

7.1 A Reporter shall not disclose any Vulnerability, related technical details, or proof-of-concept materials to any third party or the public without prior written approval from the Provider.

7.2 Upon completion of remediation, the Provider may, at its sole discretion, coordinate a joint or independent disclosure with the Reporter. The timing, scope, and content of any such disclosure shall be agreed in writing before publication.

7.3 Unauthorized disclosure constitutes a material breach of this Policy and will void any safe-harbour protections described in Section 9.

8. Rewards and Compensation

8.1 This Policy does not constitute a bug bounty programme or any offer of compensation. No payment, reward, or other consideration is owed to a Reporter by reason of submitting a report under this Policy.

8.2 The Provider may, at its sole discretion, offer recognition or other non-monetary acknowledgement to a Reporter whose submission materially contributes to the security of In-Scope Systems.

8.3 Any payment or reward shall be made only pursuant to a separate written agreement executed by the Provider and the Reporter. No oral representation or course of dealing shall create an entitlement to compensation.

9. Safe Harbour

9.1 The Provider considers good-faith security research conducted in full compliance with this Policy to be authorized activity. The Provider will not initiate or pursue civil or criminal legal action against a Reporter solely for activities that fall within the scope of, and strictly adhere to, this Policy.

9.2 This safe harbour applies only to legal claims under the Provider’s control. It does not constitute, and shall not be construed as, a promise or guarantee of immunity from action by third parties, regulatory authorities, or law enforcement agencies.

9.3 To qualify for safe harbour, a Reporter must comply with all obligations set out in this Policy, including Section 5 (Reporter Obligations) and Section 7 (Coordinated Disclosure).

10. Governing Law and Jurisdiction

10.1 This Policy and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of India.

10.2 The courts at Chandigarh, India, including the Punjab and Haryana High Court, shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this Policy.

11. Changes to This Policy

11.1 The Provider reserves the right to amend, modify, or replace this Policy at any time and at its sole discretion.

11.2 Updated versions of this Policy will be published at certyze.com. The Provider may, but is not obligated to, notify Reporters of material changes by email or other reasonable means.

11.3 The version of this Policy posted on certyze.com at the time a Vulnerability report is submitted shall govern that submission. Reporters are responsible for reviewing the current version before submitting any report.

12. Contact Information

All vulnerability reports and communications under this Policy shall be directed to the following:

Reporters should include the subject line “Vulnerability Report: Certyze” in all email correspondence to facilitate prompt routing and acknowledgement.