Security & Responsible Disclosure

Bymond Private Limited builds and operates systems that other organisations depend on, so security is part of how we work rather than a separate exercise. We take reasonable technical and organisational measures appropriate to the nature of our services, including:

• limiting access to systems and customer environments to personnel who need it for the work;
• authenticated communication between our own services, and encryption of data in transit;
• hardening, patching and monitoring of the infrastructure we operate, and separation between environments;
• protecting web-facing surfaces against automated abuse, and validating input on the server side rather than trusting the client;
• reviewing the security implications of the third-party components and providers we introduce.

When using our website, systems or services, you must not attempt to gain unauthorised access to them, to accounts belonging to others, or to any network connected to them. You must not interfere with their operation or availability, or circumvent security or access controls.

You are responsible for:

• keeping credentials, API keys and access tokens issued to you confidential, and rotating them if you believe they have been exposed;
• controlling who in your organisation has access to systems we deliver or operate for you;
• maintaining backups of data and systems under your own control;
• applying updates to systems you have taken over from us and now operate yourself.

If you believe an account, credential or system has been compromised, contact [email protected] as soon as possible.

If you believe you have found a security vulnerability in this website or in a service operated by Bymond, we want to hear about it. Report it to [email protected] with the subject line beginning Security.

What to include

• the affected URL, endpoint, system or component;
• a clear description of the issue and why you believe it is a security problem;
• the steps needed to reproduce it, with enough detail for us to confirm it;
• your assessment of the impact, and any proof-of-concept material;
• how you would like to be contacted, and whether you wish to be credited.

Testing that is careless or destructive causes real harm to real users, so we ask researchers to stay within the following boundaries.

• Give us a reasonable opportunity first. Do not disclose details of a vulnerability publicly, or to third parties, before we have had a reasonable opportunity to investigate and address it. We will work with you on timing.
• Do not access or exfiltrate data. Do not access, download, modify or delete data that is not yours. If you encounter personal or confidential data, stop, and tell us what you found without retaining a copy.
• Do not degrade our services. No denial of service testing, no load or stress testing, no automated scanning that generates disruptive traffic, and no spam.
• No social engineering or physical testing. Do not target our personnel, customers, suppliers, offices or physical infrastructure.
• Use the minimum necessary. Only go as far as is needed to demonstrate the issue, and do not maintain persistent access.
• Comply with the law. Nothing on this page authorises activity that is unlawful under any applicable law.

This policy covers systems that Bymond itself operates and controls, starting with this website.

• Customer systems are out of scope. Systems we built or operate for a customer belong to that customer. Do not test them under this policy; testing them requires authorisation from the customer that owns them. If you believe you have found an issue in one, tell us and we will pass it to the appropriate party.
• Third-party services are out of scope. Issues in cloud providers, open-source projects and other third-party platforms should be reported to those providers under their own disclosure processes.
• BigBlueButton Host. That service is operated under its own terms and policies published at bigbluebutton.host. A report about it can still be sent to the address above and will be routed appropriately.

We read every report, and we take good-faith reports seriously.

• We aim to acknowledge a security report, and to review it on its merits.
• Where we can confirm an issue, we intend to address it and to let the reporter know how we have handled it.
• We are happy to credit researchers who report an issue responsibly, if they would like to be credited.
• Bymond does not intend to pursue legal action against researchers who act in good faith, stay within this policy, and give us a reasonable opportunity to respond before disclosing.

If we become aware of a security incident affecting personal data or a customer environment we operate, we will investigate, take steps to contain and remediate it, and notify affected customers and any authority to the extent required by applicable law, including the Digital Personal Data Protection Act, 2023 and the rules made under it. Notification obligations and timelines for a specific engagement may also be set out in the applicable agreement. How we handle personal data more generally is set out in our Privacy Policy.