Responsible
disclosure

At Topicus, we take the security of our systems—our network and our products—very seriously. Despite our efforts to ensure the security of our systems, vulnerabilities may still exist. If you have found a vulnerability in one of our systems, we would like to hear from you so that we can take action as quickly as possible. 

Vulnerabilities can be discovered in two ways: accidentally as part of regular use of the digital environment, or intentionally by searching for a security vulnerability (using automated tools). Our responsible disclosure policy is not an invitation to actively and extensively scan our corporate network to discover vulnerabilities. We would like to work with you to better protect our customers and our systems. 

We ask you:

• Please email your findings as soon as possible to security@topicus.nl.
• Do not exploit the issue, for example by downloading more data than is necessary to demonstrate the vulnerability or by viewing, deleting, or modifying third-party data.
• Do not share the issue with others until it has been resolved, and immediately delete any confidential data that may have been inadvertently obtained through the vulnerability.
• Do not use hacking tools that negatively impact the availability of our systems, such as SPAM or DDOS tools.
• Provide sufficient information to reproduce the issue so that we can resolve it as quickly as possible. Usually, the IP address or URL of the affected system and a description of the vulnerability are sufficient, but more may be required for more complex vulnerabilities.

What we promise: 

• We will respond to your report within 3 days with our assessment of the report and an expected date for a resolution.
• If you have complied with the above conditions, we will not take any legal action against you regarding the report.
• We will treat your report confidentially and will not share your personal data with third parties without your consent unless it is necessary to comply with a legal obligation. Reporting under a pseudonym is possible.
• We will keep you informed of the progress in resolving the issue.
• In communications regarding the reported issue, we will, if you wish, credit you as the discoverer. 
• As a thank you for your help, we offer a reward for every report of a security issue that was previously unknown to us. We determine the amount of the reward based on the severity of the vulnerability and the quality of the report, in the form of a goodie bag or a gift card. The reward is only awarded to residents of the EU/EEA.

 We aim to resolve all issues as quickly as possible and would like to be involved in any publication regarding the issue after it has been resolved.