Diffi Technologies Ltd. wants to hear about security problems in diffi. If you think you have found one, this policy explains how to report it, what you may test, and what we will do.
1. How to report
Write to us at info@hidiffi.com. You may report without giving your name.
2. What to include in your report
- Where the problem is: the web address, or the app and the screen.
- What the problem allows someone to do.
- The steps to reproduce it, with any screenshots, requests or code that show it.
3. What is in scope
This policy covers:
- The diffi website, hidiffi.com
- The diffi product: its web app, its desktop and phone apps, and the services behind them
4. What is out of scope
- Services run by other companies, including the tools a customer connects to diffi and the providers that host diffi or supply its AI. Please report problems in those services to the companies that run them.
- Our customers’ own systems.
5. Rules for testing
Please follow these rules when you look for security problems:
- Use only accounts that you own or have permission to use.
- Do not access, change or delete data that is not yours. If you come across someone else’s data, stop, do not keep it, and tell us.
- Do not disrupt the service: no denial-of-service testing and no high-volume automated scanning.
- Do not use social engineering, such as phishing our staff or customers, and do not carry out physical tests of our offices or any other premises.
- Do only what is needed to show that the problem exists.
- Give us reasonable time to fix the problem before you tell anyone else about it.
6. What we will do
When you report a problem, we will:
- Confirm that we have received your report, as soon as we can.
- Tell you whether we could reproduce the problem.
- Keep you informed while we fix it.
7. Safe harbour
If you make a good-faith effort to follow this policy, Diffi Technologies Ltd. will not take or recommend legal action against you for your research. If a third party takes legal action against you for research that followed this policy, we will make it known that you acted under it.
8. Changes to this policy
We may update this policy. The date of the current version is shown at the top of this page.