SentiLink Verification Services Disclosures

April 18, 2022

At SentiLink Verification Services, we consider the security of our systems a top priority. But no matter how much effort we put into system security, there can still be vulnerabilities present.

If you believe you have identified a potential security vulnerability, we would like to know about it so we can take steps to address it as quickly as possible. We would like to ask you to help us better protect our clients and our systems.

Reponsible Disclosure Program Guidelines

• Do not engage in any activity that can potentially or actually cause harm to SentiLink Verification Services, our partners or our employees.
• E-mail your findings to disclosure@sentiverify.com.
• Do not store, share, compromise or destroy SentiLink Verification Services or customer data. If Personally Identifiable Information (PII) is encountered, you should immediately halt your activity, purge related data from your system, and immediately contact SentiLink Verification Services. This step protects any potentially vulnerable data, and you.
• Do not reveal the problem to others until it has been resolved,
• Do not use attacks on physical security, social engineering, distributed denial of service, spam, third-party applications or any other systems that may impact SentiLink Verification Service’s services.
• Do provide sufficient information to reproduce the problem, so we will be able to resolve it as quickly as possible. Usually, the IP address or the URL of the affected system and a description of the vulnerability will be sufficient, but complex vulnerabilities may require further explanation.

What We Promise

• We will respond to your report within 10 business days with our evaluation of the report and an expected resolution date.
• We will keep you informed of the progress towards resolving the problem.
• As a token of our gratitude for your assistance, we may offer a reward for reporting a security problem that was not yet known to us. The severity of the finding and the quality of the report will determine the reward to be issued.

Out of Scope Vulnerabilities

Certain vulnerabilities are considered out of scope for our Responsible Disclosure Program. Out of Scope vulnerabilities include:

• Physical Testing
• Social Engineering
• Phishing
• Denial of Service Attacks 
• Resource Exhaustion Attacks

Out of Scope Systems

Certain infrastructure is considered out of scope for our Responsible Disclosure Program. Out of Scope Systems include:

www.sentiverify.com

We strive to resolve all problems as quickly as possible, and we would like to play an active role in the ultimate publication on the problem after it is resolved.