Legal information

Vulnerability disclosure policy

If you find a vulnerability in DeCA2U, we want to know. This page says how to report it and what we do when we receive it.

What it covers

The DeCA2U services operated by DRIVEN2U, S.L.: the platform at app.deca2u.com, the API at api.deca2u.com, the public document download at doc.deca2u.com and this site, www.deca2u.com.

How to report it

Write to deca2u@driven2u.com with the subject "Vulnerability". Say which service and address are affected, the steps to reproduce it and the impact you believe it has. You may write in Spanish or in English.

What we do when we receive it

We acknowledge it within five business days, assess it and keep you informed until it is fixed. Where it affects personal data, we also apply our breach procedure and notify the customers affected within the time their contract sets.

What we ask of you

• Do not access, modify or keep data that is not yours. If you reach any, stop and tell us.
• Do not run denial of service, social engineering or physical tests.
• Do not make the vulnerability public until it is fixed or 90 days have passed since your report, whichever comes first.

Our commitment

We will take no legal action against anybody who researches in good faith and follows this policy. If you wish, we will credit your contribution publicly once it is fixed.