Vulnerability Disclosure Policy (VDP)

Vulnerability Disclosure Policy (VDP)


Version	1.0
Last updated	May 18, 2026
Canonical URL	https://www.titane-intelligence.com/en/legal/vdp
Contact	`security@titane-intelligence.com`

1. Our commitment

The security of the Titane Intelligence Services and of the data they process is a priority. We recognize the essential contribution of security researchers, and we are committed to treating them with respect, transparency, and recognition.

This Coordinated Vulnerability Disclosure Policy ("VDP") describes how to report a suspected security vulnerability and the mutual commitments between Titane and researchers.

2. Scope

The following are within the scope of the VDP:

the domains titane-intelligence.com, *.titane-intelligence.com, and their subdomains operated by Titane;
the public Titane Intelligence API;
the officially distributed Titane Connectors (Shopify, Klaviyo, and other Connectors published on the titane-intelligence.com site);
the SDKs and client libraries officially published by Titane.

3. Out of scope

The following are out of scope:

third-party services used by Titane (notably AWS, Anthropic, OpenAI, Neon, Vercel) — please address your reports directly to the relevant provider;
Titane profiles on social media and third-party platforms;
attacks requiring physical access to Titane premises or to employee workstations;
reports concerning software versions publicly deprecated by their vendor without a demonstration of actual exploitation on the Titane Services;
social engineering reports (phishing, vishing) targeting Titane personnel;
volumetric denial-of-service attacks (DoS / DDoS);
reports derived solely from automated scanners without manual validation.

4. How to report a vulnerability

4.1 Reporting channel

Send your report to security@titane-intelligence.com.

For particularly sensitive reports, you may request a PGP encryption key at this same address.

4.2 Expected content of the report

Please provide, to the extent possible:

a clear description of the vulnerability;
the affected components (URL, API endpoint, SDK version);
detailed reproduction steps (proof of concept);
the potential impact;
any remediation recommendation you deem useful;
your identity or a pseudonym and a means of contacting you again (desired but not mandatory).

4.3 Language

Reports accepted in French or English.

5. Titane's commitments (SLA)

Step	Commitment timeframe
Acknowledgment of receipt of the report	48 hours from receipt of the report
Initial analysis and triage	5 business days from the acknowledgment of receipt
Communication on the implementation of the fix	Depending on severity, in coordination with the researcher
Notification to the researcher of the resolution	Upon deployment of the fix to production

Titane is committed to maintaining regular and transparent communication with the researcher throughout the handling of the report.

6. Researcher's commitments

By participating in this VDP, the researcher agrees to:

a) conduct their testing without harming the confidentiality, integrity, or availability of the Titane Services and of the data processed;
b) not access, modify, delete, or exfiltrate any data other than that strictly necessary to demonstrate the vulnerability;
c) immediately stop testing as soon as a vulnerability is confirmed and alert Titane without delay;
d) observe a coordinated disclosure period: not publicly disclose the vulnerability before Titane has been able to implement a fix, within a reasonable timeframe (generally ninety (90) days, negotiable depending on severity);
e) not use the vulnerability for purposes of extortion, blackmail, or to obtain an undue advantage;
f) respect the confidentiality of the information shared with Titane in connection with the handling of the report.

7. Safe harbor

Titane is committed to not taking legal action against researchers who:

a) reported a vulnerability in good faith in accordance with this VDP;
b) complied with all of the commitments set out in Article 6;
c) did not exceed the scope defined in Article 2;
d) did not degrade or render the Services unavailable;
e) did not access more data than strictly necessary to demonstrate the vulnerability.

This safe harbor is not intended to replace the legal protections applicable to good-faith reports (notably Article L. 323-3-1 of the French Penal Code for France).

8. Recognition

Titane may, subject to the researcher's express agreement, mention their contribution on a public "Hall of Fame" page or in the security documentation.

9. Bug bounty

Titane does not, at this time, offer a monetary cash-rewarded bug bounty program. Any change to this position may be the subject of a future update to this VDP.

10. Changes to the VDP

This VDP may evolve. Any change will be published at this URL, together with a new update date.

Security contact: security@titane-intelligence.com

Version 1.0 — Last updated: May 18, 2026