Responsible Disclosure Policy

Tintify Holdings, Inc.

Last updated: March 4, 2026

1. Our Commitment

Tintify Holdings, Inc. ("Tintify") takes the security of our platform and the data of our Customers seriously. We appreciate the work of security researchers and individuals who help identify vulnerabilities in good faith. This Responsible Disclosure Policy outlines how to report security issues to us and what you can expect in return.

2. Scope

This policy applies to security vulnerabilities discovered in:

  • The Tintify web application (app.tintify.cloud)
  • The Tintify marketing website (tintify.io)
  • Tintify APIs and backend services
  • Any other Tintify-owned digital infrastructure

Out of Scope

The following are explicitly out of scope and should not be tested:

  • Third-party services or infrastructure not owned by Tintify
  • Social engineering or phishing attacks against Tintify employees or Customers
  • Physical security testing
  • Denial-of-service (DoS/DDoS) attacks
  • Automated scanning that generates excessive traffic or degrades service availability
  • Vulnerabilities in software or services not controlled by Tintify

3. How to Report

To report a suspected security vulnerability, please email us at:

security@tintify.io

Please include the following in your report:

  • A clear description of the vulnerability
  • The affected URL, endpoint, or component
  • Steps to reproduce the issue
  • Any relevant screenshots, videos, or proof-of-concept code
  • Your assessment of the potential impact
  • Your name and contact information (optional, but appreciated)

We accept encrypted communications via PGP if requested.

4. What to Expect From Us

  • Acknowledgment: We will acknowledge receipt of your report within 3 business days.
  • Assessment: We will assess the reported vulnerability and provide an initial response within 10 business days.
  • Resolution: We will work to remediate validated vulnerabilities in a timeframe appropriate to their severity.
  • Communication: We will keep you informed of our progress and notify you when the issue has been resolved.
  • Recognition: With your permission, we may recognize your contribution publicly (e.g., in a security acknowledgment page) once the issue is resolved.

We do not currently operate a paid bug bounty program, though we may offer recognition or other acknowledgment at our discretion.

5. Our Expectations of Researchers

We ask that you:

  • Act in good faith and avoid accessing, modifying, or deleting data beyond what is necessary to demonstrate the vulnerability
  • Do not exploit a vulnerability beyond what is necessary to verify it exists
  • Do not disclose the vulnerability publicly until we have had a reasonable opportunity to investigate and remediate it (we request a minimum of 90 days)
  • Do not conduct testing that disrupts or degrades our Services
  • Do not target accounts belonging to other Customers or users
  • Use test accounts you own or have explicit permission to use

6. Safe Harbor

Tintify will not pursue legal action against security researchers who:

  • Discover and report vulnerabilities in accordance with this Policy
  • Act in good faith and avoid unauthorized access to Customer data
  • Do not publicly disclose vulnerability details before we have remediated the issue

We reserve the right to pursue legal remedies in cases involving malicious intent, unauthorized data access, or willful violation of this Policy.

7. Contact

Tintify Holdings, Inc.

Email: security@tintify.io