Vulnerability Disclosure Policy

1. Our Commitment

We take the security of Trizelo, and of the workforce data our Customers trust us with, seriously. If you believe you have found a security vulnerability in Trizelo, we want to hear about it. This policy describes what we ask of you, what you can expect from us, and the safe-harbor protection we offer to researchers who report in good faith and in accordance with this policy.

2. How to Report

Email security@trizelo.app with:

• A clear description of the issue and why it is a vulnerability;
• The steps needed to reproduce it, including any URLs, request payloads, or screenshots that help us confirm it quickly;
• The potential impact, as you understand it; and
• Your contact information, so we can follow up and credit you (if you want credit) once the issue is resolved.

We will acknowledge your report within 3 business days and aim to give you a substantive update — our assessment, and an expected resolution timeline — within 10 business days of acknowledgment.

3. What We Ask of You

• Give us a reasonable amount of time to investigate and remediate an issue before disclosing it publicly, at minimum 90 days from your initial report, or until we confirm a fix is live, whichever is sooner. We will communicate with you if we genuinely need more time.
• Make a good-faith effort to avoid privacy violations, data destruction, and service interruption. Access or modify only the data strictly necessary to demonstrate a vulnerability.
• Do not test against real Customer accounts or production data you do not control. Use a test account you create yourself, or ask us for a sandboxed one.
• Do not use automated scanning tools in a way that degrades the Service for real users (for example, sustained high-volume traffic).
• Do not publicly disclose the issue, or any data obtained through it, until we have confirmed remediation or the disclosure window above has passed.

4. Safe Harbor

If you make a good-faith effort to comply with this policy, we will not pursue or support legal action against you for your research, including under computer-misuse or similar laws, for:

• Accessing or attempting to access systems or data covered by this policy, within the scope described below;
• Testing for the presence of a vulnerability, or disclosing a vulnerability you discovered through that testing; or
• Circumventing a technical control solely for the purpose of this research, where doing so was necessary to demonstrate the vulnerability.

This safe harbor applies only to conduct that stays within the scope and rules set out in this policy. Conduct outside this scope — including testing against a Customer’s production account without their separate written authorization — is not covered, and remains subject to the Acceptable Use rules in our Terms of Service.

5. Scope

In scope: the production Trizelo application at trizelo.app and its API, where the testing follows the rules in Section 3 above.

Out of scope: denial-of-service testing; social engineering of our staff, Customers, or their employees; physical attacks against our offices or a Customer’s premises; and testing against a specific Customer’s tenant without that Customer’s own separate written authorization, since that data belongs to them, not to us.