If you find a security issue in an Accel Comply website, please tell us.
In scope: accelcomply.com and the subdomains we run under it. This includes problems caused by how we have set up a third-party service or a DNS record, for example a record that points at a service someone else could claim.
Out of scope: flaws in our hosting, mail or CRM providers' own products, which belong with those providers; denial of service; social engineering; spam; physical attacks; and best-practice findings, such as missing headers, with no demonstrated impact.
If you are unsure whether something is in scope, write to us anyway.
Email [email protected] with a description of the issue, the steps to reproduce it and the impact you expect. Reports in English or Danish are welcome. Send only the evidence needed to show the issue. If it involves credentials or personal data, describe it without the data first, and we will agree a safer way to share it.
Please do not run high-volume automated scans, and do not change, keep or share data that is not yours. If you reach personal data, stop and tell us.
We aim to acknowledge your report within 5 business days, then to tell you whether it is in scope, share material updates and let you know when the issue is fixed or the report is closed. If you want credit, tell us the name or handle to use, and we will add it to this file once the fix is in place.
We treat good-faith research that stays within this policy as welcome, not hostile. Please give us up to 90 days from your report before you disclose it publicly, unless we agree a different date with you.
There is no bug bounty.