Vulnerability Disclosure Guidelines

We welcome responsible reports of vulnerabilities or issues that may impact confidentiality, integrity or availability of our systems, data, services and customers.

At this point in time we do not run a bug bounty program. This is not a solicitation of security researchers to engage in active testing. Additionally, please keep all communications with us confidential, in particular about identified vulnerabilities.

Disclosure Policy

  • Let us know as soon as possible upon discovery of a potential security issue
  • Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service

Exclusions

Whatever the case may be, you are explicitly forbidden from targeting Tipalti with:

  • Denial of service
  • Bruteforce attacks
  • Spamming
  • Social engineering (including phishing) of Tipalti staff or contractors
  • Any actions that will severely limit the use of Tipalti platform for other users
  • Any physical attempts against Tipalti property or data centers
    • Use and abuse of compromised third party and end user accounts
    • Targeting and attacking Tipalti customers and end users

Reach out to Report a Vulnerability