Security

1. Reporting a security issue

If you believe you have found a security vulnerability in the Elderon platform or website, email hello@elderon.io with the subject “Security report”. Include what you found, the steps to reproduce it, and the date and time you tested.

Reports are acknowledged within two business days, and the reporter is kept informed until the issue is resolved.

2. Testing in good faith

• Use only accounts you own or are authorised to use, and stop as soon as you have shown the issue.
• Do not access, change or keep data belonging to anyone else. If you see customer data, stop and report it.
• Do not run denial of service, spam, social engineering or physical tests.
• Give reasonable time to fix the issue before disclosing it publicly.

Elderon will not pursue legal action against research carried out in line with these terms.

3. How the platform is protected

• Each firm’s data is separated on the server for every request, and firms can restrict staff to particular clients.
• Accounts are by invitation. Two-step sign-in (authenticator app or emailed code) is available, and an Admin can require it for everyone.
• Traffic is encrypted in transit (HTTPS with HSTS, and TLS with certificate verification to the database).
• Changes to client data are recorded in an audit log, earlier versions are kept for 30 days, and deleted files can be restored for 30 days.
• Passwords are hashed, and sign-in tokens and client links are stored only as hashes.

Where data is stored and which providers process it is set out in the privacy policy. How AI is used is set out in the AI use statement.