Legal document
Security & responsible disclosure
The security of our users is an absolute priority. If you discover a vulnerability in Cyclezen, we thank you for reporting it responsibly, as described below.
How to report a vulnerability
Send an email to security@cyclezen.ai with:
- a clear and reproducible description of the problem;
- the version of the application, browser or OS concerned;
- any logs, screenshots or proofs of concept;
- your contact details (email).
If you wish, you can encrypt your message: the security team's PGP key will be published on this page before the beta launch (28 October 2026).
Our commitments
- Acknowledgement of receipt within 5 business days.
- Progress updates at least every two weeks.
- Notification of the resolution and, on request, public credit for the researcher who reported the flaw.
- Safe harbor: Cyclezen undertakes not to take legal action against security researchers acting in good faith and in compliance with the rules below.
Scope
In scope:
- The cyclezen.ai website and its production subdomains.
- The Cyclezen iOS mobile application (App Store, from the October 2026 beta).
- The public APIs exposed by
api.cyclezen.ai.
Out of scope:
- Third-party services, to be reported directly to the vendor concerned.
- Denial-of-service attacks (DoS, DDoS).
- Spam, phishing or social engineering targeting our staff or our users.
- Physical vulnerabilities of our premises.
Rules of good conduct
We ask security researchers to:
- Not access, modify or delete data other than their own.
- Use only test accounts that you have created.
- Not degrade the availability of the service.
- Not exfiltrate data: a single access is enough to demonstrate the vulnerability.
- Not disclose the vulnerability publicly before it has been fixed and we have agreed on a communication timetable (typically 90 days from the report).
Acknowledgements
Cyclezen reviews every vulnerability report and will personally thank the researchers who have contributed to the security of the application.