Skip to content
iSBERGDATA
Open navigation
Back to home
Security

Vulnerability Disclosure

If you discover a potential security vulnerability in an iSBERGDATA product or service, please report it to our team. We welcome good-faith reports that help us protect our users and systems.

Report a vulnerability

info@isbergdata.ca

Use the subject line “Security vulnerability report” and name the affected product or service.

To help us investigate, include:

  • A short summary and the affected product, service or URL.
  • A description of the issue and its potential impact.
  • Steps to reproduce, including relevant conditions or software versions.
  • A minimal proof of concept or redacted screenshots, if available.
  • Your preferred contact details for follow-up, if you wish to provide them.

Products and systems

We accept reports concerning iSBERGDATA products and services. Identify the affected system clearly so we can direct your report to the right team.

If you are unsure whether a system is operated by iSBERGDATA or whether your proposed research is covered, contact us before testing. This policy does not authorize testing of third-party systems.

Research guidelines

  • Use only accounts and data you own or have explicit permission to use.
  • Limit testing to what is needed to demonstrate the issue. Avoid disrupting services, modifying data or affecting other users.
  • Do not use denial-of-service attacks, social engineering or physical intrusion.
  • If you encounter patient information, personal information or other sensitive data, stop testing and report the circumstances. Do not copy, retain or include that data in your report.
  • Remove sensitive information from any screenshots, logs or other evidence you submit.

What to expect

  • You will receive an acknowledgment within 3 business days.
  • We will keep you informed throughout the resolution process.
  • We may ask for clarification or additional details to help reproduce and assess the issue.
  • Please coordinate public disclosure with us so there is an opportunity to investigate and address the issue. We will discuss disclosure timing with you during follow-up.

We will not pursue legal action against individuals who submit vulnerability reports in good faith and in compliance with this policy.