Vulnerability Disclosure Policy

1. Purpose

Locktera, Inc. (“Locktera,” “we,” “us,” or “our”) is committed to maintaining the security and integrity of its products, services, infrastructure, and customer information.

We recognize that independent security researchers, customers, partners, and members of the security community can play an important role in identifying potential vulnerabilities.

This Vulnerability Disclosure Policy establishes a process for reporting suspected security vulnerabilities to Locktera and outlines the procedures for responsible reporting and coordinated disclosure. This Policy does not authorize security testing or other activities beyond permissions expressly granted by Locktera.

Our objective is to encourage responsible reporting, enable timely investigation and remediation, and minimize potential risks to customers and other affected parties.

2. Scope

This Policy applies to suspected security vulnerabilities affecting Locktera-owned or operated systems, products, and services, including, where applicable:

• Locktera CORE API and associated developer interfaces and SDKs.
• Locktera Share and its web-based applications and integrations.
• Locktera Vault and related storage security services.
• Locktera Secure RAG and confidential search services.
• Locktera-controlled websites, applications, authentication services, and supporting infrastructure.

This Policy applies to the reporting of suspected vulnerabilities affecting systems owned or operated by Locktera. Inclusion of a product or service within this Policy means that Locktera accepts vulnerability reports concerning that product or service; it does not authorize security testing.

This Policy does not grant permission to conduct penetration testing, vulnerability scanning, exploitation, or other security testing of Locktera systems. Customer-controlled environments, customer storage accounts, third-party systems, and infrastructure operated by other organizations are not authorized for testing under this Policy.

Any proposed security testing requires Locktera's prior express written authorization, including an agreed scope and applicable testing conditions.

3. Reporting a Vulnerability

If you believe you have identified a security vulnerability affecting Locktera, please report it promptly.

Security Reporting Contact

To help our security team evaluate the report, please include, where available:

• A description of the suspected vulnerability and its potential security impact.
• The affected product, service, endpoint, or component.
• Steps necessary to reproduce the issue.
• Relevant technical evidence, such as sanitized logs, screenshots, or proof-of-concept details.
• The date and approximate time of discovery.
• Any known prerequisites or environmental conditions.
• Contact information for follow-up questions.

Please do not include customer confidential information, personal information, passwords, encryption keys, access tokens, or other sensitive data in an unprotected email.

If secure transmission of sensitive technical details is necessary, request an appropriate secure submission method before providing those materials.

Reports should be submitted in English where practical.

4. Responsible Reporting Guidelines

Locktera welcomes responsible reports of suspected security vulnerabilities from customers, partners, security researchers, and members of the public.

Individuals submitting vulnerability reports are expected to:

1. Report suspected vulnerabilities promptly to security@locktera.com.
2. Provide sufficient technical information to enable Locktera to evaluate and reproduce the reported issue, where reasonably available.
3. Avoid accessing, collecting, modifying, downloading, or disclosing information belonging to other users or customers.
4. Stop any activity immediately if it results in unintended access to sensitive information or disruption of a service.
5. Avoid conducting additional testing or attempting to exploit a suspected vulnerability without Locktera's prior express written authorization.
6. Refrain from publicly disclosing technical details that could facilitate exploitation while coordinating with Locktera on responsible disclosure.
7. Cooperate reasonably with Locktera during its investigation and remediation process.

Submission of a vulnerability report does not constitute authorization to conduct security testing or access systems beyond permissions otherwise expressly granted.

Researchers who wish to conduct testing must first obtain written authorization from Locktera specifying the approved systems, activities, and conditions.

5. Prohibited Activities

The following activities are not authorized under this Policy:

• Denial-of-service, distributed denial-of-service, stress testing, or actions that degrade service availability.
• Destructive testing, data deletion, corruption, or unauthorized modification.
• Social engineering, phishing, impersonation, or physical security attacks.
• Credential stuffing, password spraying, or brute-force authentication attacks.
• Accessing or attempting to extract customer information, encryption keys, credentials, tokens, or confidential content.
• Circumventing customer-defined access controls to obtain protected content.
• Installing malware, ransomware, persistent access mechanisms, or unauthorized software.
• Conducting broad automated scanning that creates excessive traffic or operational risk.
• Testing third-party services, customer-controlled storage, or infrastructure without written authorization.
• Exfiltrating data or transferring sensitive information outside authorized systems.
• Exploiting or attempting to exploit a suspected vulnerability to obtain additional access, permissions, information, or system capabilities without Locktera's prior express written authorization.

If testing unexpectedly exposes confidential information, researchers must immediately stop, avoid further access, and notify Locktera.

6. Special Considerations for Cryptographic and Data Security Research

Locktera's products incorporate encryption, access authorization, protected file containers, and security audit capabilities.

Researchers may report suspected weaknesses involving cryptographic implementations, key management, authorization enforcement, policy evaluation, protected containers, secure retrieval, or related security mechanisms.

However, this Policy does not authorize attempts to obtain customer encryption keys, decrypt customer content, bypass customer permissions to access actual protected information, or compromise production customer environments.

Researchers may submit suspected vulnerabilities identified through normal, authorized use of Locktera products or through other lawful means. Any additional testing, including testing with synthetic data or personal test accounts, requires Locktera's prior express written authorization when such testing is not otherwise permitted under applicable agreements or existing access rights.

Locktera may provide additional testing guidance or a designated environment on a case-by-case basis. No such environment is guaranteed under this Policy.

7. Locktera's Response Process

Locktera intends to handle vulnerability reports through the following process:

Acknowledgment: Locktera will endeavor to acknowledge sufficiently detailed vulnerability reports within three business days of receipt.

Initial Assessment: Locktera will endeavor to complete an initial assessment within ten business days of receipt, subject to the complexity of the reported issue and the availability of sufficient technical information.

Investigation: Our security and engineering personnel will evaluate reproducibility, severity, exploitability, and potential customer impact.

Remediation: Confirmed vulnerabilities will be prioritized based on risk, technical complexity, potential exposure, and available mitigations.

Communication: Where practical, Locktera will provide the reporting researcher with meaningful updates during the investigation.

These timeframes are operational targets, not guarantees or contractual service-level commitments. Complex issues, incomplete reports, or circumstances requiring third-party coordination may require additional time.

Locktera may use recognized vulnerability assessment methodologies, including the Common Vulnerability Scoring System (CVSS), when appropriate.

8. Coordinated Public Disclosure

Locktera supports coordinated vulnerability disclosure.

Researchers are requested not to publish technical details, exploit code, or other information that could materially increase risk before Locktera has had a reasonable opportunity to investigate and address the issue.

We encourage researchers to coordinate any proposed public disclosure date with Locktera.

The timing and content of public disclosure should take into account vulnerability severity, remediation availability, customer impact, and the risk of exploitation.

Locktera may publish security advisories or customer notifications when appropriate. Locktera retains responsibility for determining its own customer, regulatory, and contractual notification obligations.

9. Authorization and Reservation of Rights

Locktera welcomes responsible reports of suspected security vulnerabilities. However, this Vulnerability Disclosure Policy is intended solely to establish a reporting and coordinated disclosure process. It does not authorize security testing, penetration testing, vulnerability exploitation, or unauthorized access to Locktera systems, applications, infrastructure, customer environments, or protected information.

Any security testing beyond activities otherwise permitted under applicable law and existing authorized access rights requires prior express written authorization issued by a duly authorized representative of Locktera. Such authorization must identify the systems, activities, conditions, and limitations applicable to the approved testing.

Submission of a vulnerability report, or Locktera's acknowledgment, investigation, or acceptance of a report, does not constitute authorization for the activities used to discover the reported issue and does not waive any rights or remedies.

Locktera reserves all rights and remedies available under applicable law, contract, and other legal protections, including the right to respond to unauthorized access, data exposure, service disruption, misuse of its systems, or violations of applicable agreements.

Locktera may, in its discretion, consider the circumstances of good-faith reporting when determining an appropriate response to a reported incident. Nothing in this Policy constitutes a promise not to pursue legal action, a waiver of legal rights, or a guarantee of immunity from civil or criminal liability.

Locktera cannot authorize activities involving systems, information, or infrastructure owned or controlled by third parties, including its customers and service providers, without appropriate authorization from those parties.

Researchers who wish to conduct security testing should contact security@locktera.com and obtain express written authorization before beginning such activities.

10. Recognition and Compensation

Locktera appreciates responsible contributions from the security research community.

Submission of a vulnerability report does not create an entitlement to payment, a reward, public acknowledgment, employment, or any other compensation.

Unless Locktera separately announces a formal vulnerability reward program, this Policy does not constitute a bug bounty program.

Locktera may recognize individual researchers, with their consent, when appropriate.

11. Confidentiality and Handling of Reports

Locktera will use submitted vulnerability information for security assessment, investigation, remediation, and related risk management activities.

Information may be shared with authorized Locktera personnel and relevant service providers or affected parties when reasonably necessary to investigate or resolve the reported issue.

Researchers should avoid submitting unnecessary personal information or confidential third-party materials.

Personal information associated with reports will be handled in accordance with Locktera's Privacy Policy and applicable law.

12. Changes to This Policy

Locktera may revise this Vulnerability Disclosure Policy to reflect changes in its products, security practices, operational requirements, or applicable law.

Updates will be published on the Locktera website with a revised effective or last-updated date.

Individuals submitting vulnerability reports should review the current version of this Policy before reporting a suspected security vulnerability or requesting authorization for security testing.

13. Contact Information