Trust Centre
Security Reporting
If you identify a potential security issue, report it privately. We do not operate a public bug bounty, and response timelines are targets rather than contractual SLAs.
security@evidia.ai
If you identify a potential security issue, report it privately. We do not operate a public bug bounty, and response timelines are targets rather than contractual SLAs.
How to report
Email security@evidia.ai (or contact@evidia.ai with the subject prefix [SECURITY]). Please include the affected surface, reproduction steps, expected versus observed behaviour, and potential impact. If you are unsure about severity, submit it anyway.
Scope
In scope: evidia.ai and associated first-party application and API routes, and officially distributed Evidia clients. Out of scope: social engineering, denial-of-service testing, and accessing or exfiltrating data you do not own or have explicit permission to test.
What to expect
Initial acknowledgement target: within 5 business days. Initial triage or status target: within 10 business days. Validated reports receive periodic updates until closure or mitigation. Complex issues may take longer to remediate and verify.
Coordinated disclosure
We ask reporters to keep details non-public while we investigate and remediate, and we coordinate disclosure timing with the reporter where practical.