Responsible Disclosure Policy Independer

Independer's mission is to restore confidence in financial institutions and products. In it we run themselves like lead. Independer customers can be confident that we are security and privacy seriously. Our systems are protected and continuously monitored for potential weaknesses. Yet it may happen that there is a problem with the security of one of our systems.

If you have found a flaw in one of our systems, we know. Then we can take steps as soon as possible. We like to work with you to better protect our clients and systems. So we have our security better for each other.

What we ask from you:

Mail your findings to [email protected]. Encrypt your findings with our [PGP key] (http://www.independer.nl/algemeen/info/responsible-disclosure/pgp-key.aspx) to prevent the information falling into the wrong hands.

• Abuse not the issue. For example, by download more data than is necessary in order to demonstrate the problem or to view third-party data, to modify, or delete or modify systems.
• Share it with others until the problem is resolved.
• Erase the confidential information you obtained through the leak after closing the leak.
• Do not use attacks on our physical security, social engineering, denial of service attacks, spam or third party applications.
• Give us enough information to reproduce the problem so we can fix it as soon as possible. Usually the IP address or URL of the affected system and a description of the vulnerability sufficient, but more complex vulnerabilities can more information be needed..

What we promise you:

• If you stick to the above conditions, we will take legal action against you as a result of the report.
• We will respond within 3 working days your message with our assessment of the report and an expected date for a solution.
• We treat your report confidentially and will not share your personal information with third parties without your permission unless it needs to fulfill a legal obligation. You can also report anonymously or under a pseudonym: we find it more important that you report it if you have found a vulnerability than that you announced.
• We will keep you informed of the progress
• In any reporting on the reported problem, we can include your name (or pseudonym) as the discoverer. Please mention it in your report to.
• In return for your help, we offer a reward for any mention of a us unknown vulnerability. The size of the reward we determine according to the severity of the leak and the quality of the report with a minimum of a € 50, -.