PRESERVUS, LLC   |   Version 1.0   |   Effective Date: 8/18/2026

​

This policy gives security researchers clear guidelines for conducting vulnerability discovery against our systems, tells you which systems are covered, explains how to send us a report, and says how long we ask you to wait before publishing. We encourage you to contact us about potential vulnerabilities in our systems.

1.  Authorization

If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and Preservus will not recommend or pursue legal action related to your research. Should legal action be initiated by a third party against you for activities that were conducted in accordance with this policy, we will make this authorization known.

2.  Guidelines

 

Under this policy, research means activities in which you:

​

• Notify us as soon as possible after you discover a real or potential security issue.

• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.

• Only use exploits to the extent necessary to confirm a vulnerability is present. Do not use an exploit to compromise or exfiltrate data, to establish persistent access, or to pivot to other systems.

• Give us a reasonable amount of time to resolve the issue before you disclose it publicly.

• Do not submit a high volume of low-quality reports.

 

Once you have established that a vulnerability exists, or you encounter any sensitive data belonging to someone else, stop your test, tell us immediately, and do not disclose that data to anyone else. The data behind these systems belongs to real people who did not agree to be part of your research, so prove the finding and stop there rather than collecting what it exposes.

3.  Test methods that are not authorized:

​

• Network denial of service, load testing, or any other test that impairs access to or damages a system or its data.

• Physical testing, social engineering of any kind, including phishing or attempts against our account recovery process, or any other non-technical vulnerability testing.

• Testing with any account other than one you control, or any attempt to reach another person's data.

4.  Scope

This policy applies to the following systems:

 

• app.preservus.io, the Preservus web application

• api.preservus.io, the API it runs against

Any service not listed above is out of scope and is not authorized for testing. That specifically includes preservus.io and www.preservus.io, which are published on a third-party website platform we are not able to authorize testing against, and any non-production environment. Vulnerabilities in the systems of our vendors are outside this policy and should be reported to that vendor under their own disclosure policy. If you are not sure whether something is in scope, ask us before you start.

5.  Reporting a vulnerability

Email security@preservus.io, one report per issue. Reports may be submitted anonymously: we do not require your name or any other personal information, though we will acknowledge and update you only if you give us a way to reach you. We do not support PGP-encrypted email.

What you send us is used for defensive purposes only, to understand and fix the issue. If a finding affects all users of a product or service rather than Preservus alone, we may pass it to that vendor or to a coordinating body, and we will not share your name or contact information without your permission.

6.  What we would like to see from you:

 

• Where you found it and what an attacker could do with it.

• The steps to reproduce it, in enough detail that we can follow them. A short recording, a screenshot, or a request and response transcript is worth more than a scanner summary.

• In English, if possible.

 

7.  What you can expect from us:

​

• We acknowledge your report within 5 business days, from a person.

• We tell you within 10 business days whether we have reproduced it and how we intend to handle it.

• We stay in contact until it is closed, we are honest about anything delaying the fix, and we tell you when it ships.

• We credit you by name if you would like to be credited, and say nothing about you if you would not.

8.  Public disclosure

Please give us 90 days from your report before publishing, and get in touch if that does not work for you. We would rather agree on a date than read about it.

 

9.  Questions, and what we do not offer

We do not offer payment for reports and we do not run a bug bounty program. Saying so here is more honest than leaving it ambiguous until after you have done the work. Questions about this policy, and suggestions for improving it, go to the same address.

​

10.  Contact us

​

PRESERVUS, LLC

security@PRESERVUS.io