Security Policy

Responsible Disclosure

IDENETY MSP is committed to the security of our systems and the protection of our clients' data. We welcome reports from security researchers who discover potential vulnerabilities in our infrastructure, web applications, or services.

If you believe you have found a security vulnerability in any IDENETY MSP-owned system, please report it to us as described below. We will investigate all legitimate reports and do our best to quickly fix the problem.

How to Report a Vulnerability

Please send vulnerability reports to our security team using one of the following channels:

What to Include in Your Report

• A description of the vulnerability and its potential impact
• The URL, IP address, or system identifier where the vulnerability was found
• Steps to reproduce the vulnerability (proof of concept)
• Any tools or techniques used to discover the vulnerability
• Your contact information for follow-up questions

Our Commitments

• We will acknowledge receipt of your report within 2 business days
• We will provide an initial assessment within 5 business days
• We will keep you informed of our progress toward resolving the issue
• We will not pursue legal action against researchers who follow this policy
• We will credit researchers in our acknowledgments (if desired)

Scope

In scope for responsible disclosure:

• idenetymsp.com and all subdomains
• idenety.com and all subdomains
• IDENETY MSP client portal and management interfaces
• Zone Intelligence domain scanner (idenetymsp.com/scan)

Out of scope:

• Social engineering attacks against IDENETY MSP staff or clients
• Physical security attacks
• Denial of service attacks
• Vulnerabilities in third-party services not under IDENETY MSP's control

Safe Harbor

IDENETY MSP will not pursue civil or criminal action against security researchers who make a good-faith effort to comply with this policy. We consider security research conducted under this policy to be authorized and will not initiate legal action for such research. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Acknowledgments

We maintain a list of security researchers who have responsibly disclosed vulnerabilities to us. View our security acknowledgments →