Responsible Disclosure Policy
Rhaetix AG · Last updated: 09.11.2026 · Version 1.0
The security of our customers and their data is our highest priority. We welcome the responsible reporting of security vulnerabilities by security researchers and are committed to a fair and transparent handling process.
1. Scope
In scope:
In scope:
- rhaetix.com and associated subdomains
- The Rhaetix Workspace software (Managed Hosting and Self-Hosted), current version
- Associated APIs
Out of scope:
Out of scope:
- Denial-of-service attacks or load testing
- Social engineering (e.g. phishing) targeting employees or customers
- Physical access to facilities or devices
- Vulnerabilities in third-party systems (please report these to the respective provider)
- Spam, clickjacking, or purely informational configuration findings without demonstrable impact
- Self-compromised devices or accounts
2. Rules of Engagement
During your investigation, we ask that you:
- Act in good faith and only to the extent necessary to demonstrate the vulnerability.
- Do not access other users' data, and do not modify or delete any data.
- Do not impair the availability of our services.
- Use test accounts rather than production data wherever possible.
- Keep details confidential until the vulnerability has been remediated (coordinated disclosure, see § 4).
3. Our Commitments (Safe Harbor)
If you comply with this policy:
- we consider your investigation authorised and waive legal action in connection with the report;
- we treat your report confidentially and do not disclose your identity without your consent;
- we keep you informed about the status of remediation.
4. Process
| Step | Timeframe |
|---|---|
| Acknowledgement of receipt of your report | within 3 business days |
| Initial substantive assessment (severity) | within 10 business days |
| Remediation | depending on severity: critical within 14 days, otherwise within 60 days |
| Coordinated disclosure | at the earliest after remediation, in coordination with you (guideline: 90 days after report) |
5. How to Report a Vulnerability
Email: contact@rhaetix.com
Please describe as specifically as possible:
- Type of vulnerability and affected component (URL, module, version)
- Steps to reproduce (proof of concept, if possible)
- Estimated impact
- Whether and how we may credit you publicly (see § 6)
6. Recognition
We do not currently operate a bug bounty programme. Upon request, after remediation and with your consent, we will credit you by name in our acknowledgements ("Hall of Fame").
7. Legal
This policy does not establish a contract or any claim to remuneration. Swiss law applies. This policy may be amended at any time; the version published at the time of the report applies.