Cyber security
Ease2pay and cyber security.
At Ease2pay we care about your privacy and online security. We work with professional developers that work every day on securing your online safety while using our apps.
What is cyber security?
Cyber security is protecting systems, networks, devices and data from cyber-attacks such as injection, data breaches and ransomware. The goal of cyber security is to protect computer networks (both local and public) from external threats.
Ease2pay Vulnerability Disclosure Policy
Introduction
As a provider of an internet of things and payment platform, keeping user information safe and secure is a top priority and a core company value for Ease2pay. Therefore, we welcome the contribution of external security researchers for improving security of our products and our IT applications. This policy shows the framework that Ease2pay assures regarding the responsible disclosure of security vulnerabilities. This policy is subject to changes from time to time and is applicable in its latest version.
Scope
This policy applies to all networked and networkable products and components developed, produced or marketed by Ease2pay as well as to all publicly accessible IT applications of Ease2pay.
We are interested in findings, which are exploitable, are leading directly to an exploitable vulnerability or allow to remotely compromise user data.
Please note that reports regarding vulnerabilities with minimal security impact (e.g. missing headers), unverified results of automated scans, vulnerabilities beyond Ease2pay’s control and vulnerabilities in violation of the requirements stated below are out of scope.
Eligibility and Responsible Disclosure
If you believe, you have discovered a vulnerability in an IT application or have a security incident to report, please send your findings or remarks to the following address: security@ease2pay.com
Ideally, your message should contain the following information:
- Affected product/application.
- Description of identified vulnerability.
- If available: proof-of-concept code, exploit or packet capture.
To accelerate the reporting process, we ask that you:
- Share the security issue with us in detail.
- Be respectful of our applications and systems and do not disrupt operations.
- Give us a reasonable time to respond to the issue before publicly disclosing any information. We will try to contact you as soon as possible and eliminate a vulnerability within a period of 90 days. During this time, we ask you to keep all communications and information confidential. We reserve the right to change deadlines based on extreme circumstances.
- Do not access or modify our data or our users’ data, without our explicit permission of the owner. Only interact with your own accounts or test accounts for security research purposes.
- Contact us immediately if you do inadvertently encounter user data. Do not view, alter, save, store, transfer, or otherwise access the data, and immediately purge any local information upon reporting the vulnerability to the aforementioned e-mail address.
- Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services (including denial of service); and
- Otherwise, comply with all applicable laws.
Consequences of Complying with this policy
We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy in its current version. We consider activities conducted consistent with this policy to constitute “authorized” conduct. To the extent, that your activities are inconsistent with certain restrictions in our policy, we waive those restrictions for the limited purpose of permitting security research under this policy. We will not bring a claim against you for circumventing the technological measures we have used to protect the applications in scope.
We would like to thank you as an important contributor. Your hints and messages support us in making our systems more secure. We would like to express our gratitude and make reference to you in the accessible vulnerability reports. Please let us know if and under which name we can list you there.
| Date | Vulnerability report | Contributor |
| 15-12-2022 | Download 1 | Ease2pay |
If you believe, you have discovered a vulnerability in an IT application or have a security incident to report, please send your findings or remarks to the following address: security@ease2pay.com
Ideally, your message should contain the following information:
- Affected product/application.
- Description of identified vulnerability.
- If available: proof-of-concept code, exploit or packet capture.
To accelerate the reporting process, we ask that you:
- Share the security issue with us in detail.
- Be respectful of our applications and systems and do not disrupt operations.
- Give us a reasonable time to respond to the issue before publicly disclosing any information. We will try to contact you as soon as possible and eliminate a vulnerability within a period of 90 days. During this time, we ask you to keep all communications and information confidential. We reserve the right to change deadlines based on extreme circumstances.
- Do not access or modify our data or our users’ data, without our explicit permission of the owner. Only interact with your own accounts or test accounts for security research purposes.
- Contact us immediately if you do inadvertently encounter user data. Do not view, alter, save, store, transfer, or otherwise access the data, and immediately purge any local information upon reporting the vulnerability to the aforementioned e-mail address.
- Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services (including denial of service); and otherwise, comply with all applicable laws.
Dutch 
English