Portal26 welcomes reports of security vulnerabilities from researchers, customers and anyone else who finds them. This policy explains how to report a vulnerability, what you can expect from us, and the conditions under which we will not pursue legal action for good-faith research.

1. Scope

• The Portal26 platform, including the Portal26 SaaS Platform (GovCloud) offered under FedRAMP.
• Portal26 web properties under portal26.ai.

Out of scope: denial-of-service testing, social engineering or phishing of Portal26 staff or customers, physical attacks, and vulnerabilities in third-party services that Portal26 does not operate (please report those to the vendor concerned).

2. How to report

Email security@portal26.ai with:

• a description of the vulnerability and where it is (URL, component or endpoint);
• the steps needed to reproduce it, and any proof-of-concept;
• the impact you believe it has;
• how we can contact you, if you would like updates.

Reports may be made anonymously. Please do not include customer data or personal information beyond what is needed to show the issue.

3. What to expect

• Acknowledgement within 3 business days of receipt.
• Evaluation within 5 days of receipt. Reported vulnerabilities are tracked, evaluated, mitigated and reported on the same terms as any other vulnerability under our vulnerability detection and response policy.
• Updates on progress until the issue is resolved, if you provided contact details.
• Coordinated disclosure. We ask that you give us reasonable time to fix the issue before any public disclosure, and we will agree a disclosure date with you.

Portal26 does not offer monetary rewards for reports.

4. Good-faith research

If you make a good-faith effort to follow this policy, Portal26 will not pursue or support legal action against you for your research. Good faith means you:

• test only within the scope above, and only against your own accounts or data;
• stop and report as soon as you find a vulnerability, and do not access, change or delete data beyond what is needed to show it;
• do not degrade the service or affect other users;
• keep the details confidential until the issue is resolved or a disclosure date is agreed.

5. Program review

The effectiveness of this program, including how reports are received, acknowledged, evaluated and resolved, is reviewed at least quarterly by the Portal26 security team.

6. Contact

Security reports: security@portal26.ai
Machine-readable contact information: https://portal26.ai/.well-known/security.txt