Security & privacy

Report a security vulnerability

Use the security path If you found a vulnerability in a ForePath product or service, report it to [email protected]. That mailbox is the SOC / Vulnerability Disclosure intake. Do not use general sales chat or billing threads for exploit details. Also see coordinated vulnerability disclosure materials under forepath.io/legal and any security.txt published for ForePath hosts. What to send - Product and affected URL or component - A clear description of the issue and impact - Steps to reproduce without attacking other customers - Your contact details for follow-up and optional credit Do not include real customer data, live secrets, or a full public exploit write-up in the first message. What we do 1. We aim to acknowledge eligible reports within about 48 hours (published aim, not a contractual SLA unless your contract says otherwise). 2. We triage severity and track the fix. 3. We keep details confidential until a fix is available, unless we agree otherwise. Regulatory filings (when required) are handled separately from this Help article.

Privacy requests and data subject rights

Where to send privacy and DSAR requests For privacy questions and data subject requests (access, deletion, correction, and similar rights), contact: - Email. [email protected] - Phone. +49 (0) 5221 1411690 There is no separate privacy@ or DPO-only mailbox for this path. Use [email protected] so the request is triaged correctly. Policy text also appears under forepath.io/legal. What to include - Your full name and a reachable email - The right you want to exercise - Enough detail to identify your data (organization name, portal email) - Proof of identity when we ask for it Do not attach unnecessary copies of ID documents in the first message unless we request them through a secure path. What not to mix into this mailbox thread - Vulnerability reports belong at [email protected] - Illegal content notices and regulated report paths use the specialized addresses listed in "What not to send to Support" - General product how-tos belong in Help search or [email protected] as normal Support Legal deadlines for regulated requests run on their own clocks. Pending chat does not pause them.

What not to send to general Support

Never paste these into chat or hi@ tickets - Passwords, password hashes, OTP codes, TOTP seeds - JWTs, session cookies, API keys, cloud provider tokens - Stripe secrets or full payment card data - Private keys and database dumps with personal data Rotate any secret that was pasted by mistake, then tell Support that a rotation happened without resending the value. Specialized ForePath addresses | Topic | Address | | --- | --- | | Vulnerabilities / CVD / VDP | [email protected] (see also security.txt and forepath.io/legal) | | DSA-related illegal content reports | [email protected] | | TCO / takedown style reports | [email protected] (handled 24/7 per published aims) | | Authority requests | [email protected] | | Privacy / DSAR | [email protected] and +49 (0) 5221 1411690 | Response aims (not contractual SLAs) - General Support: about 2 business days - Sales: about 1 business day - Security acknowledgement: about 48 hours - DSA confirmation: about 24 hours - TCO path: 24/7 intake per published aims Contractual SLAs override these aims when present.