Security — Embernel

Last updated 1 September 2026 · Covers all Embernel products

Draft — needs your review This page is a working template written to match how the group is described elsewhere on the site. Check every statement against what you actually do before publishing, and have a lawyer review the final wording. Placeholders are marked in square brackets.

Reporting a vulnerability

Send details to security@embernel.com. Include the affected URL or endpoint, the steps to reproduce, and what an attacker could achieve. If you would like to encrypt your report, our PGP key is at [key URL].

What we commit to

Acknowledge your report within [1] working day.
Give you an initial assessment within [5] working days.
Keep you updated until it is resolved, and tell you when it ships.
Credit you publicly if you want it, and stay quiet if you do not.
Not pursue legal action against good-faith research that follows the rules below.

Rules for testing

Use only accounts you own or have permission to test.
Do not access, modify or delete data belonging to anyone else.
No denial of service, spam, social engineering, or physical attacks.
Stop as soon as you have confirmed a vulnerability, and report it rather than exploring further.
Give us reasonable time to fix it before disclosing publicly.

Out of scope

Reports that consist only of automated scanner output, missing best-practice headers with no demonstrated impact, or issues in third-party services we do not control.

How we protect data

[Describe only what you actually do today: encryption in transit and at rest, access control and least privilege, backup and restore testing, dependency scanning, logging and alerting, and incident response. Remove anything you have not implemented.]

Certifications

[List only certifications you hold and can evidence, with the issuing body and date. If an audit is in progress, say that instead of implying it is complete. Do not claim SOC 2, ISO 27001 or similar until the report is in hand.]