Reporting a Security Issue
If you have found a security problem in a Restrata product, or you are worried about the security of your account or your data, we want to hear from you. This page explains how to tell us, what we will do in response, and what we ask of you in return.
Contact us here: security@restrata.com
You do not need to be a Restrata customer. We will acknowledge your report within two business days.
What you can report here
Security problems in our products
A flaw, weakness or unexpected behaviour in the ResilienceOS app or platform that could be used to get at information or functions that should be protected. This includes anything you have found through security research.
Other security concerns
Some things are better dealt with elsewhere, and going to the right place first will get them resolved faster.
What has happened: An email, message or website pretending to be Restrata
Where to go: Email us, attaching the original message
What has happened: You think someone else has access to your account
Where to go Your organisation's ResilienceOS administrator, who can suspend it straight away. Email us if you cannot reach them.
What has happened: A phone with the app on it has been lost or stolen
Where to go: Your organisation's ResilienceOS administrator, as soon as you can
What has happened: Personal information appearing somewhere it should not
Where to go: Email us, immediately.
What has happened: Another user misusing the platform
Where to go: Your organisation's ResilienceOS administrator
If you are not sure which applies, email us anyway. We would rather hear from you and redirect you than not hear from you at all.
How to report
Report as soon as you suspect a problem - an early report of a suspected issue is more useful to us than a late report of a confirmed one.
Please include the product and version affected, what you found, the steps to reproduce it, and what impact you think it has. Screenshots, request captures or a proof of concept all help. A report we cannot reproduce is a report we cannot fix.
Please also tell us whether you are happy to be contacted or not, if you would like to be credited and under what name, and whether you plan to publish and when.
Security research: what is covered
The sections from here on apply to security research and to reports of flaws in our products. They set out what you may test, what you must not, and the protection we offer you for doing it.
In scope
• ResilienceOS mobile app for Android
• ResilienceOS mobile app for iOS
• The ResilienceOS platform and its authenticated API
• Restrata-operated internet-facing services on restrata.com
Out of scope
• Third-party services we use but do not control — please report those to the provider concerned
• Our customers' own integrations, configurations, tenants and data
• Any system, account or data belonging to someone other than you or Restrata
• Restrata corporate systems not exposed to the internet
• Our offices and our staff
What we will do, and when
Acknowledge your report: 2 business days
Tell you whether it is valid, and how serious we think it is: 10 business days
Update you while it remains open: Every 20 business days
Fix it: According to severity
Tell you the fix is available: On release
Publish an advisory: Once the fix is available
What we ask of you
Please hold off publishing until a fix is available, or until 90 days have passed since you reported it, whichever comes first.
If a fix is genuinely complex, we may ask you for more time. We will explain why and give you a revised date.
Testing
What is allowed
We authorise security testing of the products listed above, provided you:
• Test only against your own account and data, or a test account we have issued you
• Keep testing to the minimum needed to demonstrate the issue
• Stop as soon as you have evidence of a vulnerability, rather than exploring how far it goes
• Do not access, copy, change, keep or transmit anyone else's personal data — if you come across it, stop, delete any copies, and tell us straight away
• Report promptly and give us a fair opportunity to fix it
What is never allowed
Our products are used to protect people during real emergencies. Interference with them can put lives at risk. The following are never authorised, and fall outside the safe harbour below:
• Raising, cancelling, suppressing or otherwise interfering with any live emergency alarm, SOS activation, check-in or duty of care alert
• Denial of service, load, stress or resource exhaustion testing against the apps, the platform or the API
• Accessing, extracting, changing or destroying data belonging to our customers, their people, or anyone else
• Moving from something you have found into a customer's tenant, or into Restrata's corporate environment
• Social engineering, phishing, or physical intrusion aimed at our staff, customers or premises
• Deploying malware, ransomware, persistence or backdoors
• Automated scanning heavy enough to degrade the service for real users
• Publishing customer data or personal data at any point, including after the 90 days have passed
• Asking us for payment in return for not disclosing
Safe harbour
If you act in good faith and stay within this policy, we will:
• not bring or support civil or criminal proceedings against you over your research
• not report you to law enforcement over your research
• treat what you did as authorised access, for the purposes of the Computer Misuse Act 1990 and equivalent law elsewhere
By good faith we mean research intended to improve security, without intent to cause harm, extract payment, reach someone else's data, or gain commercial advantage.
This protection does not cover anything outside the scope above, anything in the "never allowed" list, extracting data, extortion, or publishing personal data. We also cannot waive other people’s rights - if you test against a customer's tenant or their data, you are outside this protection.
Credit
We will credit you by name or handle in the advisory if you instruct us to do so and provide how you wish to be identified. Credit does not depend on how serious the finding was, or on you agreeing to anything.
No bug bounty
We do not run a bug bounty programme and we do not pay for vulnerability reports. We say so plainly so you can decide how to spend your time. It changes nothing else on this page — safe harbour, our response times and credit all still apply.
Things we usually do not treat as vulnerabilities
Without a demonstrated, practical impact, these are example of issues generally out of scope:
• Missing HTTP security headers, or absence of certificate pinning, with no interception demonstrated
• Self-XSS, and clickjacking on pages with nothing to click
• Theoretical weaknesses in cryptography with no working attack
• Raw output from an automated scanner, with no impact shown
• Version disclosure, and rate limiting observations with no abuse case
• Anything that needs a rooted, jailbroken or already-compromised device, physical access to an unlocked phone, or a malicious app already installed with elevated privileges
This page is Restrata's coordinated vulnerability disclosure policy for the purposes of Regulation (EU) 2024/2847, the EU Cyber Resilience Act.
Business days are Monday to Friday, excluding public holidays in England and Wales.