Report it privately,
and we will fix it fast.

We welcome reports of security vulnerabilities in the systems we operate. If you have found something that could let one customer reach another's data, let an unauthorised person into an account, or expose data that should not be exposed, we want to hear about it.

The following are in scope for good-faith security research:

Customer production data is explicitly out of scope. Employee records, payroll, bank details, government identifiers and uploaded documents belonging to a real organization are never a legitimate research target, whatever the finding would demonstrate. If your proof of concept requires reading someone's salary or opening another company's records, stop and describe the vulnerability instead.

Prove access at the boundary. Showing that a request crosses a tenant boundary is enough; enumerating what is on the other side is not, and doing it takes a report out of safe harbour.

If you make a good-faith effort to follow this policy, we will treat your research as authorised. We will not pursue legal action against you, we will not report you to law enforcement, and if a third party brings a claim about research that stayed inside this policy, we will make it known that your activity was authorised.

Good faith means staying inside scope, stopping as soon as you have confirmed a vulnerability rather than seeing how far it goes, accessing only the minimum data needed to demonstrate the issue, not degrading the service for anyone else, and reporting promptly and privately.

This protection does not extend to accessing, downloading, retaining, altering or sharing customer data, to extortion or a threat to publish, to deliberate service disruption, or to activity that is unlawful regardless of authorisation. Safe harbour is for research, not for leverage.

If you are unsure whether something is inside the policy, ask us at info@denways.com before you test it. We would far rather answer a question than receive an apology afterwards.

Send reports to info@denways.com. Please use that address rather than support, sales or a social media channel, so the report reaches the people who can act on it without passing through more hands than necessary.

A good report is one an engineer can reproduce without a second exchange. Include enough for us to see the issue for ourselves.

We acknowledge receipt of a report within two business days. That acknowledgement is from a person, not an autoresponder.

Within five business days we come back with an initial assessment: whether we have reproduced the issue, the severity we have assigned it, and what we intend to do. Where a report is not reproducible, we say what we tried rather than closing it silently, so you can tell us what we missed.

We aim to remediate critical issues within seven days, high severity within thirty days, and medium and low severity in the normal release cycle. Some fixes take longer, usually because a proper fix means changing something structural rather than patching a symptom. Where that happens we tell you why and give you a realistic date.

We keep you updated while the work is in progress and tell you when the fix is live, so you can verify it yourself. A researcher confirming the fix is a step we want, not one we tolerate.

The following are not authorised under this policy. They are outside safe harbour whatever the intent behind them, because the harm falls on customers and their employees rather than on us.

We ask that you give us time to fix an issue before you talk about it publicly. The platform holds payroll and identity data for whole workforces, and a disclosed but unpatched vulnerability puts employees at risk, not just us.

Our standard request is ninety days from the date we acknowledge the report, or until a fix is deployed, whichever comes first. Where a fix is genuinely complex we may ask for longer, and we will explain why rather than simply asking again.

We will not use the disclosure window to stall. If we go quiet, or if we are not making credible progress, you are entitled to say so and to publish; a policy that lets a vendor sit on a report indefinitely is not a disclosure policy.

When you do publish, we are happy to review a draft for factual accuracy, and to publish alongside you. Please leave customer identities and any data you happened to see out of the write-up.

No. There is no paid bug bounty programme at present, and we would rather say that at the top of the conversation than let you spend a weekend on our platform and find out afterwards.

We do not pay for reports, and a report is not an invoice. If a paid programme is launched later, it will be announced on this page with its own terms, and it will not be applied retrospectively to reports already received.

What we do offer is a serious response: a real person reading your report, an honest assessment, a fix, and public credit if you want it. For researchers who care about whether the issue gets fixed, that is usually the part that matters.

We maintain a hall of thanks recognising researchers whose reports have led to a fix. Credit is given with your consent and never without it: tell us in your report whether you want to be listed, and under what name and link.

If you would rather stay anonymous, that is equally fine, and it does not change how your report is handled. Some of the most useful reports we receive come from people who want no attribution at all.

We list a researcher once a fix has shipped, so the entry cannot itself point at an open vulnerability. Where a finding does not result in a change, we say so honestly rather than listing it to be polite.

The hall of thanks has no published entries yet.

We update this policy as the platform and our security practice change, and the date at the top reflects the current version. Research conducted in good faith under the version of this policy in force at the time remains covered by the safe harbour that applied then.

DenwaysHR is operated by Denways Technologies LLP (LLPIN ACY-3781), registered office Varkala, Thiruvananthapuram, Kerala 695310, India.

Questions about this policy, or about whether a piece of research falls inside it, go to info@denways.com. General security questions about the product are answered on the security page.