Details

Responsible Disclosure

Betterment values the disclosure of security vulnerabilities and will seek a coordinated approach to remediate any vulnerabilities disclosed responsibly.

Betterment operates a variety of information systems which we are responsible for safeguarding and where we welcome responsible disclosure reports. These systems include but are not limited to:

*.betterment.com
*.bettermentforadvisors.com
*.bettermentforbusiness.com
*.bettermentinstitutional.com
*.bettermentsecurities.com
*.betterment.io
*.makara.com
*.makaradigital.com

How to Report a Vulnerability

To disclose a security issue affecting Betterment or our customers, please email us at [email protected]. In your email, please include:

Your name
How we can contact you
Information to help identify the asset where you have identified a vulnerability
A description of the issue
The steps to reproduce the issue

We will review and confirm any vulnerability reports and respond back to you in a timely manner. We may ask for additional information.

Prohibited Activities

While performing research to confirm a security vulnerability, please do not take any action that might harm Betterment, our employees, or our customers. Activities that are specifically prohibited include:

Any vulnerability testing that would cause a service outage (including denial of service, distributed denial of service, or other resource exhaustion attacks)
Any interaction with employees or customers (including but not limited to phishing or social engineering)
Intentionally accessing, processing, or transmitting confidential information, including personally-identifiable customer information
Exploiting vulnerabilities except for purposes of demonstration to Betterment personnel