Trust
Responsible disclosure policy
We want to hear about security problems in UpVoiced. If you think you have found one, tell us privately first, give us time to fix it, and we will work with you in good faith. How we protect data today is described on our security page.
1. How to report
Email support@upvoiced.com. Please include:
- the address or component affected (website, dashboard, API, widget or a portal);
- the steps to reproduce, with the requests and responses that show the problem;
- what an attacker could do with it, as far as you know;
- how you would like to be named if we thank you publicly, or that you prefer not to be.
Write in English if you can. We have no encryption key for reports yet, so do not paste other people’s personal data into the email; describe it instead.
2. What is in scope
- This website and the developer docs (upvoiced.com, docs.upvoiced.com).
- The UpVoiced dashboard (app.upvoiced.com), API (api.upvoiced.com), MCP server (mcp.upvoiced.com), widget (cdn.upvoiced.com), analytics proxy (ph.upvoiced.com) and the feedback portals at
<workspace>.upvoiced.com. - Feedback portals that customers serve on their own domains, for flaws in UpVoiced itself (not in the customer’s own website).
Out of scope:
- Services of our providers, such as sign-in, payments, email delivery or hosting. Report those to the provider; tell us too if UpVoiced uses them in an unsafe way.
- Denial of service, load tests and high-volume automated scanning.
- Social engineering, phishing of our team or customers, and physical attacks.
- Spam or offensive content posted to test moderation.
- Reports without a security impact, such as a missing header on a page with no sign-in or form, or software versions without a working exploit.
3. Rules for testing
- Use only workspaces and accounts you created yourself. The public demo is shared with other visitors: you may look, but do not try to break it or post harmful content there.
- Do not access, change or delete other people’s data. If you reach someone else’s data by accident, stop, do not keep a copy, and tell us what you saw.
- Respect rate limits and do not degrade the service for others.
- Do not send email or messages to people who have not agreed to take part.
- Keep the details confidential until we have fixed the issue, or for 90 days after your report, whichever comes first, unless we agree another date with you.
4. What we promise
- We confirm that we received your report within 5 business days.
- We tell you whether we can reproduce it and keep you updated until it is fixed.
- We fix confirmed issues as fast as their severity requires and tell you when we have.
- If you follow these rules in good faith, we consider your research authorised: we will not take legal action against you for it and will not ask anyone else to, and if someone else does, we will make clear that your research followed this policy. This covers UpVoiced only, not our providers’ services.
5. Thanks
We do not run a paid bug bounty. With your permission, we list the people who reported a confirmed issue below, after it is fixed.
- Nobody is listed yet.