Security Disclosure &
Vulnerability Reporting.
Responsible vulnerability coordination and procedures for requesting SOC 2 Type II and ISO/IEC 27001 documentation.
Vulnerability Coordination & Audit Protocol
Responsible disclosure guidelines. Guidelines for ethical security researchers, penetration testers, and enterprise compliance auditors.
Our security controls are independently audited across our platforms, infrastructure and deployed models. This document outlines our vulnerability disclosure policy and the process for authorized enterprise partners to request audit documentation.
1. Responsible Vulnerability Disclosure & Safe Harbor
Dscvry appreciates the efforts of security researchers in identifying potential vulnerabilities in our products and infrastructure. If you conduct vulnerability research in accordance with these principles:
- We consider your research authorized under applicable computer misuse legislation and will not pursue legal action.
- We request that you give us a reasonable period of time (minimum 60 days) to investigate and remediate the issue before publicly disclosing any details.
- You must avoid privacy violations, destruction of customer data, and disruption to production environments during testing.
2. Reporting Guidelines
To report a security finding, email our dedicated security response team at security@dscvryai.com.
Please include the following details in your report:
- Detailed description of the vulnerability and affected endpoint, package, or container image.
- Step-by-step reproduction instructions or a harmless proof-of-concept script.
- Estimated CVSS 3.1 severity and potential impact analysis.
3. Enterprise Audit Pack Requests
Authorized enterprise customers and prospective clients conducting vendor risk assessments can request our formal compliance pack under bilateral non-disclosure agreement (NDA):
- SOC 2 Type II Report: Independent auditor attestation covering the Security, Availability and Confidentiality trust service criteria.
- ISO/IEC 27001:2022 Certificate: Certified information security management system (ISMS), with its scope.
- Third-Party Penetration Test Executive Summary: Results of our annual independent third-party penetration test.
To initiate an audit review request, email security@dscvryai.com with your corporate organization details.
Bring us the work where wrong is expensive.
Start with the operational problem. We’ll work out the data, models and agents it needs, and where it should run.
Talk to us →