Responsible Disclosure Policy

Our commitment

The EVERIENCE Group and its subsidiaries attach particular importance to the security of information systems and data protection. We are committed to ensuring the availability, integrity, confidentiality and traceability of information.

Therefore, if you discover a potential or confirmed vulnerability that may affect EVERIENCE, we invite you to report it to us responsibly so that we can investigate it and take proper action.

Scope of the policy

This policy applies to systems, applications and services owned or run under the responsibility of EVERIENCE.

It allows you to report vulnerability but does not allow security tests to be undertaken without the prior written consent of EVERIENCE. In particular, it does not authorize any testing of systems, applications, or data belonging to clients or third parties, including when they are used as part of an EVERIENCE service.

Rules of Conduct

We welcome reports from security researchers, customers, partners, vendors, and anyone else, subject to the following principles:

• If you discover a vulnerability, do not perform any further verification. Do not exploit the vulnerability, and do not access any other information you are not authorized to view. Do not modify or delete any data.
• Do not use automated tools or methods that could disrupt services. This specifically excludes physical security testing, social engineering (including phishing), denial-of-service (DoS/DDoS) attacks, spam campaigns, and scam attempts.
• Keep vulnerability information confidential. Any public communication, including after remediation, must be agreed upon with EVERIENCE and with its prior written consent.
• Limit the personal data included in the report to what is strictly necessary, and mask or anonymize it whenever possible.
• Reports must be made in good faith and with the unique goal of contributing to the improvement of the security of the systems concerned.

How do I send a report?

Please send your report to: soc@everience.com (This email address is for security vulnerability reports only; other inquiries will be ignored).

To allow us to analyze the problem, write down if possible:

• the IP address or URL of the affected system, along with the date of your discovery;
• a description of the vulnerability and the circumstances of its discovery, based only on the elements already available, without conducting any other testing.
• the CVE identifier, if any, and any other useful references (e.g. OWASP or MITRE ATT&CK); if necessary, screenshots, logs or compressed videos, without sensitive data.
• a way to contact you if you wish to be informed of the follow-up given to your report.

Do not send sensitive data by unencrypted email. If sending such data is essential, please contact us first at this address to figure out whether a suitable method of transmission can be arranged. If no agreed-upon method is available, do not send this data.

Processing of reports

We acknowledge receipt as soon as possible, analyze the information provided, and manage the report confidentially. When possible and appropriate, we inform the reporter of the progress of the analysis and the actions taken.

Finally, as of this date, EVERIENCE does not take part in any bug bounty programs and does not offer financial rewards for vulnerability reports. Furthermore, sending a report does not confer any rights to the systems, services, products, or assets of EVERIENCE or any third parties.