Security & Responsible Disclosure Policy

This policy explains how to report security vulnerabilities affecting the CUEBES platform, what protections we extend to good-faith security researchers, and how we handle personal-data breaches under GDPR. CUEBES is operated by vaicat B.V. (KvK 89360672, The Hague, Netherlands).

1. Reporting Vulnerabilities

1.1 How to Report

If you discover a security vulnerability, please report it to security@vaicat.com.

1.2 What to Include

• A clear description of the vulnerability
• Steps to reproduce
• Potential impact assessment
• Any proof-of-concept code, where helpful
• Your preferred contact channel for follow-up

1.3 Response Timeline

• Initial acknowledgment: within 5 business days
• Initial assessment: within 10 business days
• Remediation target: within 90 days for confirmed vulnerabilities

1.4 Priority Handling

We prioritise vulnerabilities affecting authentication and authorisation, personal-data protection, payment processing (where applicable), and core infrastructure security.

2. Safe Harbor Protection

2.1 Our Commitment

We extend legal protection to security researchers who:

• Act in good faith to identify and report vulnerabilities
• Avoid privacy violations or data access beyond what's necessary to demonstrate the issue
• Do not disrupt service availability for other users
• Follow the guidelines in this policy
• Allow reasonable time for remediation before public disclosure

2.2 What Safe Harbor Covers

For qualifying research, we will not:

• Pursue civil claims against you for the research itself
• Refer your activities to law enforcement
• Take adverse action against your CUEBES account

2.3 Limitations

Safe harbor binds vaicat B.V. only. We cannot bind third parties, government authorities, or co-tenants on shared infrastructure. If your research touches a third-party service that we use, you must comply with that party's policy as well.

3. Scope

3.1 In Scope

• cuebes.eu — the CUEBES web platform and all its features (Codicles, CUES, Cubes, Wave, Talent Bank, research, messaging, EU rights flows)
• Integrated apps: EUnify, mEUvy, EUorigin, CathAI
• Public APIs documented under /api
• Authentication and authorisation systems (Apple Sign In, Magic Link, Password)
• Data-protection and privacy controls (GDPR rights flows, consent management, retention)
• End-to-end encrypted messaging surfaces (key management, not message contents)

3.2 Out of Scope

• Social-engineering attacks against employees, contractors, or users
• Denial-of-service (DoS / DDoS) attacks of any kind
• Physical-security testing of vaicat premises or hosting providers
• Automated scanning that materially degrades performance
• Vulnerabilities in third-party services and infrastructure (report those to the third party)
• Vulnerabilities exclusive to outdated browser or operating-system versions
• Issues that require physical access to a victim's unlocked device

4. Disclosure Timeline

4.1 Coordinated Disclosure

We ask researchers to allow reasonable time for remediation before public disclosure, coordinate disclosure timing with our security team, and avoid sharing vulnerability details with third parties during remediation.

4.2 Our Target

We generally target remediation within 90 days for confirmed vulnerabilities. Critical issues affecting authentication, end-to-end encryption, or personal-data protection receive expedited handling.

4.3 Public Acknowledgment

With your consent, we may publicly acknowledge your contribution to improving CUEBES security in our security advisories or release notes.

5. Prohibited Actions

The following actions fall outside safe harbor:

• Extortion or threats: demanding payment under threat of disclosure
• Data exfiltration: accessing or downloading more data than necessary to demonstrate the issue
• Service disruption: DoS attacks or actions affecting availability
• Unauthorised access: accessing accounts or data of other users without their consent
• Social engineering: phishing or manipulating employees or users
• Premature disclosure: public disclosure before the coordinated timeline expires

6. Our Security Practices

6.1 Technical Measures

• Encryption in transit: TLS 1.2+ for all CUEBES surfaces
• End-to-end encryption: for direct messages (server cannot read content)
• Access controls: least-privilege role-based access for staff systems
• Authentication: Apple Sign In, password+optional 2FA, magic-link sign-in
• Monitoring: security-event logging, anomaly detection, audit trails (cuebes_admin_audit_logs)
• Backups: regular encrypted backups
• Security headers: CSP, Permissions-Policy, HSTS via SecurityHeaders middleware

6.2 Organisational Measures

• Security awareness for everyone with platform access
• Documented incident-response procedures
• Security requirements for third-party processors (see Subprocessor List)
• Periodic security reviews and dependency audits

6.3 User Responsibilities

To help protect your account:

• Use a strong, unique password and enable 2FA
• Keep your devices and browsers updated
• Report suspicious activity immediately
• Never share your login credentials, API tokens, or personal-access tokens

7. Data Breach Notification

In compliance with GDPR Articles 33–34, we maintain documented procedures for detecting, assessing, and responding to personal-data breaches.

7.1 What Constitutes a Breach

A personal-data breach is any security incident leading to unauthorised access, unauthorised disclosure, loss, destruction, or unauthorised alteration of personal data.

7.2 Internal Response Procedure

• Detection (immediate): identify and confirm the incident; contain ongoing breach
• Assessment (within 24 hours): evaluate scope, data affected, risk to individuals
• Authority notification (within 72 hours): report to the supervisory authority where required
• User notification (without undue delay): notify affected individuals where the risk is high
• Documentation (ongoing): record all breach details and response actions
• Review (within 30 days): post-incident analysis and process improvement

7.3 Supervisory Authority

We notify the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) within 72 hours of becoming aware of a breach that is likely to result in a risk to individuals' rights and freedoms. Notification includes the nature of the breach, categories and approximate number of individuals affected, likely consequences, and measures taken or proposed.

7.4 User Notification

We notify affected individuals without undue delay when a breach is likely to result in a high risk to their rights and freedoms — for example, when financial data, identity documents, credentials, or sensitive personal data may be compromised.

7.5 Notification Content

When we notify you of a breach, we will provide: a description of what happened, the types of data involved, likely consequences, the steps we have taken, the steps you can take to protect yourself, and contact information for follow-up.

7.6 Reporting a Suspected Breach

If you believe your data may have been compromised or you notice suspicious activity, email security@vaicat.com with subject "Suspected Data Breach" and any relevant details.

8. Bug Bounty Program

vaicat B.V. does not currently operate a paid bug-bounty program. We offer:

• Public acknowledgment in security advisories, with your consent
• Safe-harbor protection (section 2)
• Our gratitude for helping improve CUEBES security

9. Contact

• Security reports: security@vaicat.com
• General support: support@vaicat.com
• Response time: 5 business days acknowledgment, 90-day remediation target
• RFC 9116: machine-readable contact at /.well-known/security.txt

Operator

• vaicat B.V.
• Noordeinde 99B, 2514 GD The Hague, Netherlands
• KvK (Dutch Trade Register): 89360672