Security Policy and Vulnerability Disclosure

Purpose#

This policy presents the security principles applied by IMEDIATIS TECHLAB SARL and describes the procedure for responsibly reporting a security vulnerability, in good faith.

Scope#

This policy applies to the trust.imediatis.cm site as well as to the products operated by IMEDIATIS TECHLAB SARL, within the limits specified below.

Definitions#

• Vulnerability: a technical or organizational weakness that could compromise the security of a system or of data.
• Responsible disclosure: the confidential, good-faith communication of a vulnerability, without exploitation or prior public disclosure.

Principles#

IMEDIATIS TECHLAB SARL applies security-by-design and security-by-default principles across its systems, notably:

• encryption of communications (HTTPS required);
• access to data limited on a need-to-know basis;
• regular updates of software dependencies;
• monitoring of service availability;
• separation of development, test and production environments.

Rules and commitments#

Technical measures#

The site applies, among others, the following security headers: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. No non-essential third-party script is loaded.

Prohibited testing#

As part of a responsible disclosure, anyone identifying a vulnerability agrees not to:

• access, modify or delete data that does not belong to them;
• disrupt or degrade the availability of a service (denial-of-service attacks);
• use social-engineering techniques against IMEDIATIS employees, customers or partners;
• publicly disclose a vulnerability before it has been resolved and without IMEDIATIS's prior agreement.

Good-faith commitment#

IMEDIATIS TECHLAB SARL commits to handling with seriousness and diligence any report made in good faith and in compliance with the rules above, and not to pursue legal action against individuals who have followed this procedure.

Handling procedure#

1. Receipt of the report at the dedicated address.
2. Acknowledgement and initial assessment by the technical team.
3. Analysis, remediation and, where necessary, coordination with the parties concerned.
4. Feedback to the reporter on the handling of the report, where possible.

Confidentiality#

Reports are handled confidentially. Information provided is used solely for the purpose of resolving the reported vulnerability.

Responsibilities#

The technical team of IMEDIATIS TECHLAB SARL is responsible for receiving, triaging and handling security reports, under the supervision of general management for significant incidents.

Exceptions#

This policy does not constitute a paid bug bounty program. It only describes a responsible disclosure framework.

Rights or reporting#

Any vulnerability may be reported through our contact form (category "Security / vulnerability"), indicating reproduction steps, the estimated impact and, where possible, a non-destructive proof of concept. The dedicated email address for security researchers is also published in the /.well-known/security.txt file.

Contact#

Any report may be sent through our contact form (category "Security / vulnerability").

Document updates#

This policy is reviewed at least twice a year and whenever the infrastructure or identified threats change significantly.

Version history#