Vulnerability Reporting Policy
Our Commitment
Atine Labs™ Limited welcomes responsible disclosure of security vulnerabilities in our products and infrastructure. We are committed to working with security researchers in good faith and to addressing confirmed vulnerabilities promptly.
Scope
This policy covers:
- www.alglobal.systems and all *.alglobal.systems subdomains
- Atine Labs™ SaaS platforms (AtineHR™, AtineCRM™, AtineERP™, AtineSuite™, and others)
- Publicly accessible APIs operated by Atine Labs™ Limited
Out of scope: third-party services not under our control; social engineering attacks; physical security; denial-of-service testing.
How to Report
Email: admin@alglobal.systems with subject line "Security Vulnerability Report".
Please include:
- Description of the vulnerability and affected system
- Steps to reproduce
- Potential impact assessment
- Any supporting screenshots or proof-of-concept (without causing harm)
Our Response Commitments
- Acknowledgement within 3 business days
- Initial assessment within 7 days
- Critical vulnerabilities: remediated within 72 hours of confirmation
- High vulnerabilities: remediated within 7 days
- Researchers are notified when vulnerabilities are resolved
Responsible Disclosure Guidelines
We ask researchers to: avoid accessing or modifying client data; not disrupt services; not disclose publicly before we have had a reasonable opportunity to remediate; and not conduct testing that could impact other users.
Recognition
We acknowledge verified contributors who follow responsible disclosure in our security acknowledgements. We do not currently operate a paid bug bounty programme, but recognise significant contributions publicly with the researcher's permission.
Questions about this policy?
Contact our Data Protection Officer or our general administration team.
Atine Labs™ Limited · Registered in Uganda. Origin: Oyam, Uganda.