Responsible Disclosure Policy

Introduction

Security is central to Elevatry because customers of the Elevatry Platform entrust confidential content to us. We welcome reports from security researchers and others who help us make the Platform more secure. This Policy describes how you can report vulnerabilities to us, what we expect of you and what you can expect from us.

1. Scope

1.1 In scope are the Elevatry Platform with the components Elevatry, Elevatry API and Elevatry App (including the iOS app) and the website www.elevatry.ai and the domains media.elevatry.ai, static.elevatry.ai and auth.elevatry.ai. Vulnerabilities count that may affect the confidentiality, integrity or availability of these systems or the data processed in them.

1.2 Of particular interest are: access to data or functions of another tenant, bypass of authentication or permissions, code execution outside the intended isolation (for example in the isolated environments for AI-generated code), disclosure of credentials or keys, and prompt injection or comparable attacks that lead to data leakage, unauthorized actions or cross-tenant impact.

1.3 Out of scope are: (a) systems and services of third parties, such as model providers, cloud providers, hosting and identity services (please report to them directly), (b) systems, configurations and connected systems of customers, (c) purely qualitative problems of AI models, such as incorrect answers (“hallucinations”) without security impact, (d) reports of missing security headers or comparable best-practice deviations without concrete exploitability.

2. Rules for Testing

2.1 Please act in good faith with the aim of improving security, and use only your own accounts and your own test data.

2.2 Not permitted are: (a) denial-of-service attacks and high-load tests, (b) social engineering, phishing or attacks on employees, customers or service providers of Elevatry, (c) physical attacks, (d) modifying, deleting or downloading data that does not belong to you, (e) accessing data of other tenants beyond what is strictly necessary to demonstrate the vulnerability, (f) installing malware or persistent access, (g) sharing or publishing data you have accessed, and (h) spam and mass automated scans.

2.3 If you accidentally access customer data or personal data, stop testing immediately, do not copy or store any data, delete any existing copies and report the incident to us.

3. How to Report a Vulnerability

3.1 Send your report to security@elevatry.ai. You can also find our contact details in the security.txt file at https://www.elevatry.ai/.well-known/security.txt; this Policy is available at https://www.elevatry.ai/security.

3.2 In your report, please include, where possible: a description of the vulnerability and its impact, the affected component or URL, steps to reproduce or a proof of concept, test accounts used, times of testing and your contact details. Please do not send customer data or other sensitive data in the report.

3.3 Please treat your findings as confidential until we have remedied the vulnerability or the period under Section 5 has expired.

4. What You Can Expect from Us

4.1 We endeavor to acknowledge receipt of your report within three working days (target value) and will review it carefully.

4.2 We will inform you of the status, in particular our assessment of the vulnerability and whether and when we will remedy it. We assess severity by recognized standards, such as the Common Vulnerability Scoring System (CVSS).

4.3 We do not promise fixed remediation deadlines, but we endeavor to remedy the vulnerability in line with its severity.

4.4 We treat your report and your contact details as confidential and share them only with persons required for processing.

5. Coordinated Disclosure

5.1 We ask you to publish vulnerabilities only once we have remedied them or you have agreed the timing with us.

5.2 No later than 90 days after we receive your report, you may publish the vulnerability if we have not agreed another date by then. If a vulnerability is actively exploited or there is a significant risk to third parties, we will agree a shorter or longer period with you.

5.3 A publication must not disclose customer data, personal data or credentials.

6. Legal Notes

6.1 If you act within this Policy and in good faith, Elevatry will not take civil action against you or file a criminal complaint on that account.

6.2 This commitment applies only to Elevatry’s systems. It does not bind customers, service providers, authorities or other third parties, and it does not replace any authorization required under applicable law. Statutory provisions, in particular on spying out and intercepting data (Sections 202a et seq. German Criminal Code), remain unaffected. The commitment under Section 6.1 lapses in the event of violations of this Policy, in particular access to third-party data beyond what is necessary, extortion attempts or disclosure of data.

6.3 This Policy does not create a contractual relationship or any claim to remuneration.

7. Recognition

7.1 On request, we will name you in our “Hall of Fame” at https://www.elevatry.ai/security once the vulnerability has been remedied. Please tell us in your report whether and under what name we may name you.

7.2 In suitable cases we show our appreciation at our own discretion by way of a token of recognition. There is no entitlement to recognition or to its nature or amount.

8. Data Protection

We process your contact details and the content of your report to handle it, communicate with you and ensure the security of our systems. The legal basis is Art. 6(1)(f) GDPR. We store the data until the report is closed and afterwards only as long as necessary to evidence and defend claims (as a rule seven years). Further information is available in our Privacy Notice.

9. Changes

We may change this Policy at any time. The version published at https://www.elevatry.ai/security at the time of your report applies.

10. Language

This Policy is provided in German and English. Only the German version is legally binding. The English version is a non-binding translation for information purposes. In the event of discrepancies or questions of interpretation, the German version prevails.