Security
We care about the security of our platform and our customers' data. This page explains how to report a security issue and what we commit to in return.
Reporting a vulnerability
If you believe you have found a security issue in any Saphyroo product, please email security@saphyroo.com.
Include a description of the issue, steps to reproduce, and the impact you observed. We acknowledge every report.
Safe harbour
We will not pursue legal action against good-faith researchers who:
Avoid harm
Make a good-faith effort to avoid privacy violations, data destruction, and service disruption
Go no further than the proof
Do not exploit a vulnerability beyond what is necessary to demonstrate it
Give us time to fix it
Give us reasonable time to remediate before public disclosure
Stay within the law
Comply with applicable law
Scope
- In scope*.saphyroo.com web properties, the Saphyroo app (iOS, Android), and the Saphyroo API at api.saphyroo.com.
- Out of scopeThird-party services we use (please report to those vendors directly), social-engineering attempts against our staff, denial-of-service attacks, and issues already publicly disclosed.
Machine-readable security contact
A machine-readable security contact is published at https://saphyroo.com/.well-known/security.txt (RFC 9116).
Privacy and data-protection requests
For data-protection (GDPR / UK DPA / Australian Privacy Act) requests, contact privacy@saphyroo.com.
Last updated: 25 April 2026