Responsible Disclosure Policy

Welcome

We appreciate good-faith reports that help us protect customers and systems.

How to report

Email security@farqadcloud.com or use the disclosure form. Include:

• affected URL/system
• description and proof-of-concept steps
• impact assessment
• your contact details

Do not include real personal data of third parties in proof-of-concept payloads.

Rules of engagement

• No destruction of data or degradation of service
• No social engineering of staff or customers
• No privacy violations or access to data beyond what is needed to demonstrate the issue
• No scanning that generates significant traffic volume

Scope

This authorization covers farqadcloud.com and other systems that we identify in writing as owned or controlled by Farqad Cloud. Customer environments, third-party services, social engineering, physical testing, denial-of-service testing, and systems not expressly in scope are excluded.

Our commitments

• Acknowledge reports within a reasonable time (target: 3 business days)
• Keep you informed of remediation progress where appropriate
• Not pursue legal action against good-faith research that follows this policy

Safe harbor

For research conducted in good faith and in compliance with this policy, we consider the activity authorized and do not intend to initiate legal action. If a third party initiates action, we may confirm that the activity complied with this policy. This statement cannot bind third parties or law enforcement and does not authorize violations of other applicable law. Extortion, unnecessary data access or retention, and public disclosure before reasonable remediation coordination fall outside this safe harbor.

Change notification

We may update this policy to reflect legal, operational, or service changes. Material changes will be communicated on this page or through another appropriate notice. Where required by law or contract, we will provide additional notice. Where affirmative consent or a contractual amendment is required, continued use alone will not replace that process.