Responsible Vulnerability Disclosure Policy

Last Updated: 19 November 2025

At Digitamize Inc., we are committed to maintaining the security and integrity of our platforms, services, and customer data. We value the contributions of security researchers and members of the community who help us improve our security posture by responsibly discovering and reporting potential vulnerabilities.

This Responsible Vulnerability Disclosure Policy outlines how to report security issues to us and what you can expect in return.

Our Commitment

Digitamize Inc. will:

Acknowledge receipt of valid vulnerability reports.
Conduct a timely investigation of reported issues.
Work to remediate confirmed vulnerabilities as quickly as possible.
Maintain open and professional communication throughout the process.
Not pursue legal action against good-faith security researchers who adhere to this policy.

Reporting a Vulnerability

If you believe you have discovered a security vulnerability affecting any Digitamize Inc. system or service, please notify us immediately.

Report to: security@supervity.ai

When reporting, please include:

A detailed description of the vulnerability.
Steps to reproduce the issue, including any proof-of-concept code or screenshots.
The affected system, service, endpoint, date, time and URL with any other additional details as much possible.
Your contact information (so we may reach you for clarification).

Please encrypt sensitive information using our PGP key (mentioned below). Encryption is optional but encouraged.

Guidelines for Responsible Disclosure

To be considered a good-faith actor, researchers are expected to:

Avoid exploiting vulnerability beyond the minimum necessary for proof of concept.
Avoid accessing or modifying data that does not belong to you.
Avoid disrupting services, degrading performance, or conducting denial-of-service (DoS) testing.
Give us reasonable time to investigate and resolve the issue before publicly sharing any details.
Follow all legal and ethical guidelines when conducting research.

Safe Harbor

Digitamize Inc. welcomes security research conducted in good faith. We will not pursue legal action against researchers who:

Follow this Responsible Disclosure Policy.
Do not intentionally harm Digitamize Inc. or its customers.
Do not attempt to access data without authorization.
Do not exploit, share, sell, or misuse discovered vulnerabilities.

If in doubt, please contact us first.

Out-of-Scope Activities

The following are strictly prohibited:

Social engineering attacks (including phishing or impersonation of employees).
Physical security testing of facilities or office locations.
Attacks against third-party providers or cloud infrastructure not owned by Digitamize Inc.
Automated scanning, that may impact service availability.
Attempts to access customer data or confidential information.

Recognition

Currently, Digitamize Inc. does not operate a public bug bounty program. However, we may choose to acknowledge researchers who responsibly disclose validated vulnerabilities, subject to our discretion and permission.

Avoid exploiting vulnerability beyond the minimum necessary for proof of concept.
Avoid accessing or modifying data that does not belong to you.
Avoid disrupting services, degrading performance, or conducting denial-of-service (DoS) testing.
Give us reasonable time to investigate and resolve the issue before publicly sharing any details.
Follow all legal and ethical guidelines when conducting research.

What You Can Expect

Once a vulnerability is reported:

You will receive an acknowledgment within 5 business days.
We will evaluate and validate the report.
If confirmed, we will prioritize remediation based on severity and impact.
We may request additional information if needed.
Once resolved, we will notify you of the fix.

Thank You

Digitamize Inc. appreciates the efforts of the security community in keeping our platform safe. Your responsible reporting helps us better protect our customers and continuously improve our services.