Trust & Security
Security & Vulnerability Disclosure
We welcome good-faith reports from independent researchers. Corzlabs is a software studio, not a certified hosting provider: we do not hold SOC2 or ISO certifications yet and we do not claim them. What we do commit to is written below.
Reporting a finding
Send a report to security@corzlabs.com with the affected host, a reproduction path, and the impact you believe is reachable. Please do not test against production customer data, do not run denial-of-service testing, and give us a reasonable window to remediate before public disclosure.
Acknowledgement of a report< 24 hours
Triage & severity classification< 72 hours
Remediation for critical findings< 7 days
Reports that follow this policy are handled under a safe-harbour commitment: we will not pursue legal action for accidental, good-faith violations of this policy. A human reads the security inbox.
How we work Least-privilege access to client repositories Secrets in a managed store, never committed to a repo Dependency and framework security updates on a schedule NDA and full IP assignment as standard Data processing terms available on requestSee roles we staff