CapEngage AI Engine·Active Sync

CapEngage AI Engagement Platform

Loading Intelligent Customer Journeys...

Real-Time CDP · Predictive Decisioning · 6 Native Channels

Data Privacy & SecurityVersion 2.4

Vulnerability Disclosure & Bug Bounty Policy

Outlines safe harbor guidelines, reporting channels, scope of security testing, triage response SLAs, and coordinated disclosure rules for ethical security researchers.

Effective Date: August 8, 2026

Last Updated: August 8, 2026

1.Safe Harbor Commitment for Security Researchers

CapEngage values the contribution of the independent cybersecurity community in protecting our systems and user data. If you conduct vulnerability research in good faith and in compliance with this Vulnerability Disclosure Policy ('VDP'), we commit to:

• Legal Safe Harbor: CapEngage will not initiate legal action or report researchers to law enforcement for accidental or good-faith security research. • Collaboration: We will work with you to understand, validate, and remediate reported security issues promptly.

2.Scope of Security Testing

• In-Scope Targets: Core web application (`app.capengage.com`), marketing website (`capengage.com`), public REST APIs (`api.capengage.com`), and SDK libraries. • Out-of-Scope Activities: Denial of service (DDoS/DoS) attacks, automated spamming, social engineering/phishing of CapEngage staff, physical security attacks against data centers, or accessing/altering data belonging to other customer accounts.

3.Vulnerability Reporting Procedure & Response SLAs

Submit security reports directly to security@capengage.com with detailed reproduction steps, proof-of-concept (PoC) scripts, and impacted API endpoints.

Our Security Incident Response Team (SIRT) enforces the following SLAs: 1. Initial Acknowledgment: Within twenty-four (24) hours of report submission. 2. Triage & Severity Assessment: Within three (3) business days. 3. Remediation & Patch Deployment: High/Critical severity issues patched within seven (7) days.

4.Coordinated Public Disclosure

Researchers agree to maintain strict confidentiality regarding reported vulnerabilities and allow CapEngage a 90-day window to remediate issues prior to any public disclosure or write-up publication.