At Telgea, the security of our platform and the privacy of our customers are fundamental to everything we do. We welcome security researchers who invest their time and effort in helping us keep Telgea safe. If you believe you have found a security vulnerability, privacy issue, or other security concern in any of our assets, we want to hear from you. This policy outlines how to report vulnerabilities to us, what we ask of you, and what you can expect from us in return.

Systems in Scope

This policy applies to digital assets owned and operated by Telgea, including:

  • Telgea Website (telgea.com)
  • Telgea mobile apps for iOS and Android
  • Telgea customer and admin portals under the telgea.com domain

Any asset not explicitly listed above should be considered out of scope. If you are unsure whether a system is in scope, contact us before testing.

Access

We currently do not offer special access to the Telgea platform for security researchers. Research must be conducted using accounts you own and are authorized to use.

Out of Scope

The following are considered out of scope for this policy:

  • Reports from automated scanners or tools without an accompanying proof-of-concept exploit
  • Missing HTTP security headers or best-practice recommendations without a detailed proof of concept demonstrating impact
  • Vulnerabilities in equipment, software, or services not owned or operated by Telgea
  • Social engineering or phishing attacks targeting Telgea users, customers, or staff
  • Email enumeration that reveals whether an address is registered with Telgea
  • Brute-force attacks
  • Denial-of-Service attacks or any testing that degrades or exhausts service resources

Our Commitments

When you report a vulnerability to us in accordance with this policy, we commit to:

  • Responding to your report promptly and working with you to validate it
  • Keeping you informed about our progress as we investigate and remediate the issue
  • Remediating validated vulnerabilities as quickly as our operational constraints allow
  • Extending Safe Harbor protections to research conducted in good faith under this policy

Our Expectations

In order to qualify for the protections in this policy, we expect you to:

  • Follow this policy and any other relevant agreements; where there is a conflict, this policy takes precedence
  • Report any vulnerability you discover promptly
  • Avoid violating the privacy of others, disrupting our systems, destroying data, or harming the user experience
  • Use only the official reporting channel described below to discuss vulnerabilities with us
  • Keep the details of any discovered vulnerability confidential until it has been resolved, and allow at least 90 days before any public disclosure
  • Perform testing only on systems in scope, and never test out-of-scope systems
  • If you gain unintended access to data: access the minimum required to demonstrate the vulnerability, stop immediately, and report it — do not view, alter, save, store, transfer, or otherwise process the data
  • Interact only with test accounts you own or accounts you have explicit permission from the account holder to use
  • Not engage in extortion

How to Report a Vulnerability

Please send your report to security@telgea.com and include as much of the following as possible:

  • A summary of the vulnerability and its potential impact
  • Step-by-step instructions to reproduce the issue, ideally with screenshots or a video
  • The browser, operating system, and device used during testing
  • Proof-of-concept code, URLs, or parameters where applicable

Rewards

We currently do not maintain a formal bug bounty program. However, for exceptional submissions we may, at our sole discretion, offer a reward and publicly acknowledge your contribution.

Safe Harbor

We consider security research conducted in good faith and in accordance with this policy to be authorized. For such research, Telgea commits to:

  • Not pursuing or supporting legal action against you for research that complies with this policy
  • Making it known that you acted in good faith and in compliance with this policy if a third party initiates legal action against you

Please note that we cannot authorize security research on infrastructure owned by third parties, including the mobile network operators and other partners we work with. Safe Harbor applies only to systems owned and operated by Telgea.

Thank you for helping keep Telgea and our customers safe.