Get Early Access

Security Policy

Last updated

Keeping our customers’ data safe is a priority at NPAmplify. We welcome reports from security researchers and users who find vulnerabilities in our Services, and we will work with you to fix them quickly.

1. How we protect the Services

  • Encryption in transit (TLS) and at rest.
  • Row-level access controls that keep each workspace’s data separate.
  • Least-privilege access for staff, with multi-factor authentication on administrative systems.
  • Encrypted storage of third-party access tokens, which are revoked when an account is disconnected.
  • Regular dependency updates and security patching.
  • Backups and a documented incident response process.

2. Reporting a vulnerability

Email [email protected] with:

  • a description of the vulnerability and its potential impact;
  • steps to reproduce it, including any URLs, request payloads, or screenshots; and
  • your name or handle, if you would like to be credited.

What we’ll do:

  • acknowledge your report within 3 business days;
  • give you an initial assessment within 10 business days; and
  • keep you updated until the issue is resolved.

3. Safe harbor and rules of engagement

We will not pursue legal action against researchers who act in good faith and follow these rules:

Do:

  • test only against accounts you own, or accounts you have explicit permission to test;
  • stop and report as soon as you find a vulnerability;
  • give us reasonable time to fix the issue before disclosing it publicly.

Do not:

  • access, change, or delete other customers’ data;
  • run denial-of-service attacks, spam, or high-volume automated scans;
  • use social engineering or phishing, or attack our staff, offices, or physical infrastructure;
  • test third-party services we use, such as social media platforms or AI providers. Report those issues to the provider directly.

Out of scope:

  • missing security headers that have no demonstrated impact;
  • clickjacking on pages with no sensitive actions;
  • self-XSS;
  • reports from automated scanners that have not been verified;
  • rate-limit or brute-force findings on non-authentication endpoints;
  • issues that affect only outdated browsers.

4. Rewards

NPAmplify does not currently run a paid bug bounty program.

We are grateful for every responsible report and are happy to credit researchers publicly.

5. Acknowledgements

With their permission, we publicly thank researchers who responsibly report valid security issues to NPAmplify. Recognized researchers will be listed on this page.