Security and vulnerability disclosure

Last updated: 3 October 2026

Security is at the core of what we do. This policy describes how to report security vulnerabilities in Kodvalley systems and how we handle such reports. It follows the principles of coordinated vulnerability disclosure promoted by ENISA under the NIS2 Directive.

1. How to report

Send your report to security@kodvalley.com or open a ticket with the security department in the client portal. Please include a description of the issue, the affected system or URL, steps to reproduce, the potential impact and your contact details. Our contact details are also published in security.txt.

2. Scope

In scope: kodvalley.com, the client portal and systems operated by Kodvalley. Out of scope: systems of our customers hosted on our infrastructure (please contact the customer, or report abuse to abuse@kodvalley.com), third party services, and findings that require physical access, social engineering of our staff or denial of service.

3. Rules for researchers

• act in good faith and only to the extent necessary to demonstrate the vulnerability;
• do not access, modify or delete data that does not belong to you; stop and report immediately if you encounter personal data;
• do not perform denial of service, spam or automated scanning that degrades our services;
• give us reasonable time to fix the issue before any disclosure, normally 90 days.

4. Our commitment

• we acknowledge your report within 3 working days;
• we keep you informed about our assessment and the remediation;
• we will not take legal action against researchers who follow this policy in good faith;
• with your permission, we credit you when the issue is resolved.

5. Security incidents affecting customers

Customers with an active security incident should use the priority incident channel in the client portal. Personal data breaches are handled according to our Data Processing Agreement.