Security Policy and Vulnerability Disclosure

1.1. Cyberangels manages information security through an information security management system certified to ISO/IEC 27001, and a quality management system certified to ISO 9001.

1.2. The technical and organizational measures applied to the processing of customer data are described in the Data Processing Agreement (cyberangels.io/dpa); their details are confidential and available to customers on request.

1.3. Incidents affecting customers' personal data are notified as set out in the Data Processing Agreement.

2.1. Vulnerabilities can be reported by writing to operations@cyberangels.io, in Italian or English.

2.2. To help us verify the report, please include:

• a description of the vulnerability and its potential impact;
• the affected URL, component or system;
• the steps to reproduce it, with any supporting evidence such as screenshots or requests;
• the date of discovery and your contact details.

2.3. Do not include personal data or confidential information of third parties beyond what is strictly necessary.

3.1. Anyone performing security research in good faith must:

• limit testing to what is necessary to demonstrate the vulnerability;
• not access, modify, delete or retain data belonging to Cyberangels, its customers or third parties, and stop testing as soon as such data is encountered;
• not degrade the service, for example through denial-of-service attacks, load testing or mass messaging;
• not use social engineering, phishing or physical attacks against Cyberangels personnel, offices or suppliers;
• not use the scanning features of the Platform against third-party assets without authorization;
• not disclose the vulnerability publicly before Cyberangels has fixed it or before an agreed period has elapsed.

3.2. Activities carried out in compliance with these rules fall within the responsible vulnerability disclosure provided for in Sections 5.2 and 13.2 of the Terms and Conditions of Use.

4.1. Acknowledge receipt of the report and keep you informed about the progress of its verification and remediation.

4.2. Handle the report and your personal data confidentially, in accordance with our Privacy Policy.

4.3. Agree with you, if you wish, on the timing and manner of any disclosure, and credit your contribution.

5.1. The scope covers the cyberangels.io website, its subdomains operated by Cyberangels and the Platform.

5.2. Third-party services integrated into the Website, such as booking, analytics or consent-management tools, are out of scope and should be reported to their respective providers.

6.1. This policy may be updated. The current version is published at cyberangels.io/security-policy and is referenced by the security.txt file.