DR-IT security incident and vulnerability disclosure policy
Effective date: 1 November 2026
Reporting address: info@dritsoftware.com (use the subject “Security vulnerability report”)
1. Purpose and scope
DR-IT welcomes good-faith reports of suspected security vulnerabilities affecting its commercial products, public website, download/distribution systems, documentation, licence services, or business systems. This policy explains the reporting route and DR-IT’s coordinated-disclosure process. It does not authorise testing beyond the boundaries below.
2. Report safely
Email info@dritsoftware.com with a clear subject such as “Security vulnerability report”. Include, where possible:
- affected product/service and version;
- affected operating system, framework, environment, or URL;
- a clear description, impact, and reproduction steps or proof of concept;
- whether exploitation is known or suspected; and
- a contact method for follow-up.
Do not include credentials, personal data, customer documents, payment data, or exploit code that could cause harm unless DR-IT has agreed a secure handling route. Encrypt sensitive report material where practical and provide the key through a separate channel.
3. Good-faith testing boundaries
When investigating, act in good faith and avoid disruption, privacy invasion, persistence, data alteration, exfiltration, social engineering, denial of service, bulk scanning, or access beyond what is necessary to demonstrate the issue. Do not test third-party services, customer systems, employee accounts, or production systems without explicit written permission. Stop testing and report promptly if you encounter personal data or confidential information.
If you follow these boundaries, DR-IT will not seek to pursue legal action solely for the good-faith reporting activity described here. This statement does not authorise unlawful activity, remove third-party rights, or require DR-IT to pay a reward.
4. DR-IT handling process
DR-IT will use reasonable efforts to:
- acknowledge a credible report within five business days;
- record, triage, and assess the affected product/service, severity, scope, and exploitation risk;
- contain material risk where appropriate;
- investigate and prepare a fix, workaround, mitigation, configuration guidance, or other response as appropriate;
- communicate with the reporter where contact details are available and it is appropriate; and
- publish a security notice where warranted, taking account of customer safety, exploit risk, and legal obligations.
These are targets, not a contractual SLA. DR-IT may need to coordinate with customers, suppliers, maintainers, law enforcement, or other affected parties.
5. Disclosure and security notices
DR-IT follows coordinated vulnerability disclosure. Please allow reasonable time for validation and remediation before publishing details. DR-IT may publish advisories containing affected versions, severity, mitigations, fixes, acknowledgements (with permission), and update guidance. DR-IT will not disclose a reporter’s identity without permission unless required by law.
Security notices will be published on the DR-IT website when disclosure is appropriate.
Non-security product bugs: info@dritsoftware.com.
Privacy/data-protection concerns: info@dritsoftware.com.
6. Personal-data incidents
For a personal-data breach, DR-IT will activate its incident-response process, assess whether notification to a supervisory authority is required within 72 hours of becoming aware of the breach, and communicate with affected individuals where GDPR Article 34 requires it.