Acknowledged.
Every report gets a human reply within 48 hours — not an auto-responder.
Security · Coordinated disclosure
Test us.
We would rather hear it from you than read it in the news. If you find a weakness in anything we run, tell us. Good-faith research is authorised, we answer within 48 hours, and we thank you in public.
The deal
What we promise.
Summarised from the Clavitor Vulnerability Disclosure Policy, which governs reports about clavitor.com and the Clavitor service. The policy is the binding text.
Assessed.
A meaningful assessment within a week, and updates while we work on the fix.
No lawyers.
We will not pursue researchers who act in good faith: no privacy violations, no data destruction, no service disruption.
Thanked in public.
Your name on our acknowledgments page — or not, if you prefer. We don't run a paid bounty.
Where to send it
One channel per product.
Each product publishes its own policy. When in doubt, write to security@clavitor.ai and we will route it — nothing gets lost between teams.
| Product | In scope | Report to | Policy |
|---|---|---|---|
| Clavitor | clavitor.ai, every *.clavitor.ai POP, the vault API and web app, clavitor-cli, the HTTPS proxy, browser extensions | security@clavitor.ai PGP available |
|
| VaultDB | The engine and its file format — a failing test against the crate is the fastest path to a fix | security@vaultdb.ch 3 business days |
|
| inomi | inomi.health and the health dossier | See policy | |
| Callitor | callitor.ai and the Stella assistant | security@clavitor.ai | |
| Securitor | securitor.ai and published reports | security@clavitor.ai | |
| clavitor.com | This site | security@clavitor.ai |
Out of scope.Social engineering, denial of service, physical attacks, and third parties such as Paddle or Cloudflare.
Stop at real data.If you reach another person's data, stop and report. Use the minimum access needed to prove it.
Give us time.Coordinate public disclosure with us after a fix, or a reasonable deadline agreed together.
Scan gently.Automated scanning that degrades service for other people is not research.
Before you start
Read what we already publish.
We publish our edges, not just our strengths. The fastest way to find something new is to start where we already said we are weakest.
Threat models
VaultDB publishes what each guarantee does not protect. Clavitor publishes its honest failure list.
Independent audits
Our own code goes through Securitor's multi-lab panel. Critical and High findings close with a regression test; the rest are published.
Architecture
Per-field encryption, hardware-derived keys, scoped agent tokens and a tamper-evident audit chain — documented in full.