ieso

Vulnerability Disclosure Policy

How to responsibly report a security issue to ieso

Effective: 4 August 2026 · Owner: ieso Security Team · Contact: security@ieso.ai

ieso builds digital mental-health care. The security and privacy of the people who use our services matter deeply to us, and we welcome the work of security researchers in helping us keep them safe. This policy explains how to report a vulnerability to us, what you can expect in return, and the rules that keep testing safe and lawful for everyone.

Before anything else — patient data is off limits. ieso processes sensitive personal and clinical health information. You must never attempt to access, view, modify, download, or retain any real patient, client, or clinical data. If you encounter such data during testing, stop immediately, do not save it, and tell us at once at security@ieso.ai.

1How to report

Send your report by email to security@ieso.ai. Where possible, encrypt sensitive details using our PGP public key, published at https://ieso.ai/.well-known/pgp-key.txt and referenced from our security.txt.

What to include

A clear, actionable report helps us fix issues faster. Please include:

The type of issue and the affected asset (URL, domain, endpoint, or component).
Step-by-step instructions to reproduce it, including any required accounts, requests, or payloads.
Proof-of-concept material (screenshots, request/response captures, a short video) — with any incidentally exposed personal data redacted.
Your assessment of the impact and how it might be exploited.
How you'd like to be credited, if at all (see Recognition below).

2Scope

The following are in scope:

The ieso.ai website and public-facing corporate/marketing assets.
ieso's product and platform services — velora.ieso.ai — subject to the strict data-handling rules in this policy.

Out of scope

The following are not authorized under this policy and should not be tested:

Any system that would require accessing real patient, client, or clinical data.
Denial-of-service (DoS/DDoS), volumetric, or resource-exhaustion attacks.
Social engineering, phishing, or physical attacks against ieso staff, patients, clinicians, or offices.
Attacks requiring physical access to a user's device, or compromise of a user's account/session.
Third-party services and vendors ieso uses but does not operate — report those to the relevant provider.
Automated scanning that generates excessive traffic or degrades service for others.

Commonly out-of-scope findings

Unless you can demonstrate a realistic security impact, we generally do not consider the following actionable: missing security headers or cookie flags without a concrete exploit; reports produced solely by automated scanners; SPF/DKIM/DMARC configuration suggestions; rate-limiting or best-practice recommendations; self-XSS; clickjacking on pages with no sensitive state-changing action; and version-disclosure banners.

3Rules of engagement

To stay within this policy, please:

Use only your own test accounts and data. Never interact with, or attempt to access, accounts or data belonging to real users.
Minimize impact. Access only the minimum needed to demonstrate an issue; stop as soon as it's confirmed.
Do not exfiltrate, alter, or destroy data, and do not degrade or interrupt our services.
Do not use the issue beyond what's needed to prove it — for example, no pivoting, persistence, or lateral movement.
Keep it confidential. Give us a reasonable opportunity to remediate before disclosing anything publicly (see Coordinated disclosure).
Comply with the law at all times.

4Safe harbor

If you make a good-faith effort to comply with this policy during your research, ieso will consider your activity authorized. We will not pursue or support legal action against you for accidental, good-faith violations, and we will work with you to understand and resolve the issue quickly.

This authorization does not extend to actions that intentionally harm ieso, our patients, clinicians, or staff; that access or retain sensitive data beyond what is needed to demonstrate a finding; or that otherwise breach this policy or the law. If legal action is initiated by a third party against you for activity conducted under this policy, we will make it known that your actions were carried out in compliance with it. This policy does not, and cannot, waive the rights of any third party.

5What you can expect from us

Stage	Our commitment
Acknowledgement	We will confirm receipt of your report within 3 business days.
Triage	We will validate and assess severity, and give you an initial assessment, within 10 business days.
Progress	We will keep you reasonably informed as we work toward a fix.
Coordinated disclosure	We aim to resolve valid issues promptly and support public disclosure, by mutual agreement, once remediated — typically within 90 days of the report.

We handle all reports confidentially and will not share your details with third parties without your permission, except where required by law.

6Recognition

ieso does not operate a paid bug-bounty program and does not offer monetary rewards under this policy. We are, however, genuinely grateful for responsible disclosures. With your permission, we are happy to publicly acknowledge your contribution once an issue is resolved. Let us know in your report whether you'd like to be credited and how you'd like your name to appear.

7Coordinated disclosure

We ask that you keep the details of any vulnerability confidential until we have had a reasonable opportunity to remediate it, and that any public disclosure be agreed with us in advance. We are committed to working with you on a timeline that protects users while giving appropriate credit for your work.

ieso Vulnerability Disclosure Policy · This page is referenced from the Policy field of ieso's security.txt (RFC 9116).