Last updated November 6, 2026

We want SimpleAudit to be safe for the companies that trust us with their compliance records. If you think you have found a security vulnerability in SimpleAudit, please tell us. We will work with you to understand it and fix it.

How to report a vulnerability

Email privacy@simpleaudit.io with "Security vulnerability" in the subject line. Please include:

what you found and where, such as the page address or feature
the steps we can follow to reproduce it
what you think an attacker could do with it
how we can reach you with follow-up questions

Please do not send us other people's personal data. If you need to show that data was exposed, a description or a redacted screenshot is enough.

What happens after you report

We confirm that we received your report within 5 business days.
We keep you updated while we investigate, and we tell you when the issue is fixed.
We ask you to give us 90 days from your report to fix the issue before you share any details publicly. If we need longer, we will explain why and agree a new date with you. If we fix it sooner, we can agree to an earlier date.

What is in scope

simpleaudit.io, including the SimpleAudit app and its APIs
trust.simpleaudit.io, including the trust center pages we host for our customers

What is out of scope

Services run by the providers listed on our sub-processors page. Please report those to the provider directly.
Denial-of-service attacks, load testing, or anything else that slows down or interrupts the service
Phishing, social engineering, or physical attacks against our staff or customers
Spam or sending unwanted messages through our forms
Automated scanner results or missing security settings with no demonstrated security impact

Rules for testing

Only use accounts you own or have permission to use, and only look at data in those accounts.
If you see data that belongs to another customer, stop and report it. Do not view more, copy, change, or delete it.
Do not run tests that could slow down or interrupt the service for anyone else.
Do not keep access after you have found an issue, and do not use what you find for anything except reporting it to us.

Safe harbor

If you make a good-faith effort to follow this policy, we will treat your research as authorized. We will not take legal action against you or ask law enforcement to investigate you for it. If someone else takes legal action against you for research that followed this policy, we will make it known that we authorized it.

Rewards

We do not pay for reports or offer other rewards. This is a disclosure policy, not a bug bounty program.

Machine-readable contact

Our security contact is also published in security.txt, the standard file (RFC 9116) that security researchers and tools look for.

Vulnerability Disclosure Policy