Security Contact and Vulnerability Disclosure

1.1Report a suspected vulnerability or security incident to info@eriusphone.com with the subject line "Security report". This is our general support address; a separate security mailbox has not been set up. Reports are read by the people who operate the Service.

1.2Customers with a question about the security of their own Account or Device can also open a support ticket in the Dashboard. If you believe an API Key has been disclosed, say so in the first line so that it can be revoked.

1.3We aim to acknowledge a report within five (5) business days. We do not commit to a time for a fix; we will tell you what we have decided and, where we can, when.

2.1A description of the issue and why you consider it a vulnerability; the address, endpoint or component affected; the steps to reproduce it; the date and time of your test and the network address you tested from; and how to reach you. Do not include personal data of other people or working credentials in the report.

3.1In scope: the website at eriusphone.com, the API at api.eriusphone.com, the Dashboard, the sign-up and call pages, and the isolation between Accounts and Devices.

3.2Out of scope: services of third parties, including the applications available on a Device and the providers we use; findings that depend on physical access, on social engineering of our staff or customers, or on a compromised device of the user; reports generated by automated scanners without a demonstrated impact; the absence of a security header or best practice without a demonstrated impact; and denial-of-service.

4.1You may test only against an Account and Devices that are your own. Do not access, modify or delete data that is not yours. If you come across another person's data, stop, do not keep or share it, and report it.

4.2Do not degrade the Service: no denial-of-service, no load testing, no automated scanning at a rate that affects other users.

4.3Do not attempt to leave a Device's container to reach the host or another customer's Device beyond the minimum needed to demonstrate that it is possible, and report at once if it is.

4.4Do not use a finding for any purpose other than reporting it to us, and do not disclose it to others until we have confirmed that it is resolved or ninety (90) days have passed since your report, whichever is earlier, unless we agree otherwise.

4.5Comply with the law that applies to you.

5.1If you act in good faith and within clauses 3 and 4, we will treat your testing as authorised under the Acceptable Use Policy, will not suspend your Account because of it and will not bring a civil claim or make a complaint to an authority against you in respect of it.

5.2We cannot authorise testing of systems that are not ours, and clause 5.1 does not bind any third party or public authority.

5.3We do not operate a bug-bounty programme and do not pay for reports. With your permission we will acknowledge your contribution.

6.1If we confirm a breach of security that affects a Customer's data, we notify the Customer as set out in clause 8.3 of the Privacy Policy and, for business Customers, clause 9 of the Data Processing Addendum.

6.2The current state of the Service is shown on the status page at eriusphone.com/status.

Protremix Technology Limited, Office A, Innovation City Business Centre, RAK BANK ROC Office, Ground Floor, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates. Licence no. 07011554. Printable copy: PDF.