Security
Vulnerability disclosure policy
The security of AITEZA and our customers' data is our top priority. If you believe you have found a security vulnerability, please let us know. We appreciate every responsible report.
How to report a vulnerability
Please send your report by email to security@aiteza.ai. Reports in German or English are welcome. Where possible, include:
- a description of the vulnerability and its potential impact
- the affected URL, component or version
- the steps needed to reproduce it, ideally with a proof of concept
- how we can reach you for follow-up questions
A machine-readable version of this contact is available at /.well-known/security.txt.
What you can expect from us
- We confirm receipt of your report, usually within five business days.
- We assess the report and keep you informed about our progress.
- We treat your report confidentially and do not share your personal data with third parties without your consent.
- If you wish, we will credit you by name once the vulnerability has been fixed.
Rules for researchers
- Only access, change or delete data to the extent strictly necessary to demonstrate the vulnerability. Do not access other users' data.
- Do not carry out denial-of-service attacks, social engineering, phishing or physical attacks.
- Do not use automated scanners in a way that impairs the availability of our services.
- Do not exploit the vulnerability beyond what is necessary, and delete any data obtained once the report is complete.
- Give us reasonable time to fix the issue before disclosing it publicly, and coordinate the disclosure with us.
Scope
This policy covers the website aiteza.ai and the AITEZA platform operated by weyer data engineering gmbh. Not in scope are:
- services and systems of third parties, such as embedded booking or video providers
- reports without demonstrable security impact, for example missing best-practice headers or version disclosure alone
- vulnerabilities that require physical access to a device or a compromised end device
Legal safe harbor
If you act in good faith and comply with this policy, we will not take legal action against you in connection with your report. This does not apply if you clearly act with criminal intent.
No bug bounty programme
We currently do not run a bug bounty programme and do not offer financial rewards for reports.
