Responsible disclosure

Last updated 12/08/2026

The Dutch text is authoritative. English is a courtesy translation.

Last updated: 12 August 2026
Contact: info@finbaze.com

FinBaze takes the security of our products, services, and customer data seriously. We welcome reports of security vulnerabilities from researchers and users acting in good faith. This page describes how to report a potential issue and what you can expect from us.

We do not operate a bug bounty programme and do not offer monetary compensation, rewards, or other payment for vulnerability reports.

1. Scope

This policy covers publicly reachable FinBaze systems and applications that we operate, including:

  • The FinBaze marketing website (finbaze.com)
  • The FinBaze SaaS platform and related customer-facing web applications
  • Official FinBaze APIs and integrations that we expose for customer use

Where a third-party service or infrastructure provider is involved, we may need to coordinate with that party. Reports should still be sent to us first.

2. How to report

Please email info@finbaze.com with the subject line Responsible disclosure.

Include as much of the following as you reasonably can:

  • A clear description of the vulnerability and its potential impact
  • The affected URL, endpoint, product area, or component
  • Steps to reproduce (or a proof of concept that does not cause harm)
  • Your preferred contact details for follow-up
  • Whether you intend to publish or disclose the finding elsewhere, and on what timeline

Do not include customer data, personal data of third parties, or credentials belonging to others beyond what is strictly necessary to demonstrate the issue.

3. Safe harbor (good faith)

If you investigate and report a vulnerability in good faith, in accordance with this policy, and without causing unnecessary harm, FinBaze will not pursue legal action against you for that research.

Good faith means, among other things, that you:

  • Make a good-faith effort to avoid privacy violations, disruption of service, and destruction or alteration of data
  • Do not exploit a vulnerability beyond what is needed to confirm it
  • Do not access, copy, or retain data that is not your own, except as minimally needed to demonstrate the issue
  • Report the finding promptly and keep details confidential until we have had a reasonable opportunity to address it
  • Do not use social engineering, physical attacks, or denial-of-service techniques

This safe-harbor statement does not authorise activity that is illegal, reckless, or outside the scope of this policy.

4. What we ask you not to do (out of scope)

The following are out of scope and must not be performed:

  • Social engineering (including phishing) of FinBaze staff, customers, or partners
  • Physical attacks against offices, data centres, or devices
  • Denial of service (DoS / DDoS), volumetric attacks, or intentional service disruption
  • Spam, brute-force credential stuffing against production systems at scale, or automated scanning that degrades availability
  • Attacks against third-party services, vendors, or customers that are not operated by FinBaze
  • Testing that modifies or deletes production data, or that affects other customers’ accounts
  • Disclosure of findings to the public or to third parties before FinBaze has had a reasonable opportunity to remediate, unless required by law

Reports limited to outdated software banners, missing security headers without a demonstrated impact, or purely theoretical issues without a viable attack path may receive lower priority or may not receive a detailed response.

5. No compensation

FinBaze does not offer a bug bounty, paid reward, gift, or any other form of monetary or non-monetary compensation for security reports. Submission of a report does not create any entitlement to payment, credit, employment, or preferential treatment.

We appreciate responsible reporting and may, at our sole discretion, acknowledge contributors when appropriate — but we make no commitment to do so.

6. What you can expect

We aim to acknowledge receipt of valid reports when we can. Response times vary with severity, volume, and available capacity; we do not commit to fixed service levels or SLAs on this page.

After acknowledgement, we may ask clarifying questions, request additional detail, or inform you when a fix has been deployed. We are not obliged to share internal remediation timelines, root-cause analysis, or customer-impact details.

7. Related documents

Questions about security reporting?

Reach FinBaze B.V. or FinBaze Limited via the contact page.

Contact