Vulnerability Disclosure
Last updated November 3, 2026
Security is central to a platform that handles business data. We welcome reports from security researchers and users who find potential vulnerabilities in DataSeller AI, and we commit to working with you to understand and resolve issues quickly. This policy explains how to report a vulnerability and what you can expect from us.
1. 1. How to report
Email security@dataseller.ai with a description of the issue, the affected URL or component, steps to reproduce, the potential impact and any proof-of-concept. Please include your contact details so we can follow up. If you would like to encrypt your report, ask us for a public key in your first message.
2. 2. Scope
In scope: our marketing website, the DataSeller AI web application, hosted storefronts and checkout pages, data delivery endpoints and our public API.
Out of scope: third-party services we do not control, including our payment processor's hosted checkout; denial of service and volumetric testing; social engineering, phishing or physical attacks; spam; findings from automated scanners without a demonstrated impact; missing best-practice headers without a practical exploit; and issues affecting only outdated or unsupported browsers.
3. 3. Rules of engagement
Use only accounts you own or test accounts you create. Do not access, modify or delete data belonging to other users; if you encounter such data, stop, do not retain it, and report it immediately. Do not degrade the Service for others, do not attempt to re-identify individuals from data products, and do not publicly disclose a vulnerability before we have resolved it or agreed on a disclosure date.
4. 4. Safe harbor
If you make a good-faith effort to comply with this policy, we will consider your research authorized, will not pursue legal action against you, and will not report you to law enforcement in relation to that research. If a third party brings legal action against you for activities conducted under this policy, we will make it known that your actions were authorized.
5. 5. Our response
We aim to acknowledge reports within 3 business days, provide an initial assessment within 10 business days, and keep you informed of progress until the issue is resolved. We prioritize fixes based on severity and potential impact.
6. 6. Recognition
We do not currently operate a paid bug bounty program. With your permission, we are happy to publicly acknowledge researchers who report valid, previously unknown vulnerabilities once they have been fixed.
7. 7. Coordinated disclosure
We ask that you give us a reasonable period, typically 90 days, to address a vulnerability before any public disclosure. We will work with you on timing and may publish a security advisory where appropriate.