Security & Trust

If you believe you have found a vulnerability or that an account has been compromised, please contact us before disclosing publicly. Email privacy@corpbolt.com with subject SECURITY REPORT, or call +1 (307) 300-2206.

For active account-takeover incidents, also send a copy to hello@corpbolt.com.

We aim to acknowledge within 2 business days. We do not pursue legal action against security researchers acting in good faith under the rules in §7.

• Least privilege. People and services get only the access they need.
• Defense in depth. Multiple, independent controls protect each asset.
• Encrypt by default. Data is encrypted at rest and in transit.
• Audit by design. High-risk actions are logged and reviewable.
• Vendor due diligence. Subprocessors are screened, contractually bound, and monitored.
• Continuous improvement. Security debt is tracked and burned down over time.

• Company laptops are full-disk-encrypted and kept current.
• Security-awareness training is provided to staff handling customer data.
• Acceptable Use rules require unique credentials, MFA where supported, and no credential sharing.

We engage third-party processors ("subprocessors") to deliver the Services. We sign written data-protection terms with our subprocessors where they handle Personal Data, and we review them periodically for security posture, geography, and reliability. We do not transfer Personal Data outside the categories disclosed in the Privacy Policy.

We follow a documented process:

1. Detect — alerts from monitoring, vendor notices, user reports, or security research.
2. Triage — severity rated; communications and technical leads notified.
3. Contain — isolate affected systems; rotate credentials and keys as needed.
4. Eradicate — remove the root cause.
5. Recover — restore services with monitoring.
6. Notify — notify regulators and affected individuals per applicable law and contracts:
   • GDPR / UK GDPR: notify the supervisory authority within 72 hours of becoming aware of a personal-data breach where required; affected individuals "without undue delay" where high risk.
   • U.S. state breach-notification laws: notify per each affected state's law.
   • HIPAA: not in scope — we do not knowingly process PHI.
   • Business customers under a DPA: notified per the DPA's commitments.
7. Learn — post-incident review with documented corrective actions.

We welcome reports from security researchers. Rules of engagement:

• Test only against accounts you own, or accounts you have explicit written permission to test.
• No DDoS, no destructive testing, no social engineering of staff or customers.
• No accessing or downloading customer data beyond the minimum needed to demonstrate the issue.
• No public disclosure for 90 days or until we publish a fix, whichever is earlier.
• Provide a clear write-up at the channel in §1.

We do not currently operate a paid bug-bounty program. This may change.

Business customers can request our DPA, which addresses:

• our role as Processor and Customer's role as Controller (or Processor on behalf of a controller);
• documented Customer instructions and confidentiality;
• the technical and organizational measures we apply;
• sub-processor authorization, change notice (≥ 30 days), and objection rights;
• assistance with data-subject requests, security obligations, breach notification, DPIAs, and consultation with supervisory authorities;
• audit and information-request rights;
• international transfers (EU SCCs Module 2 / 3, UK Addendum, Swiss adjustments, transfer-impact assessment);
• CCPA/CPRA Service Provider / Processor obligations;
• return or deletion on termination;
• liability allocated under the Terms of Service.

To request the DPA, email privacy@corpbolt.com with subject DPA REQUEST and a short description of your processing. We will return a signature-ready version.

We are transparent about what we have and what we are working toward. We do not claim certifications we do not hold.

• SOC 2 Type II: not currently certified. We track readiness internally.
• ISO/IEC 27001: not currently certified. We track relevant controls internally.
• PCI DSS: Stripe handles card data so CORPBOLT's PCI scope is minimised. We complete the appropriate Self-Assessment Questionnaire (SAQ) tier for our Stripe-Elements + tokenized flow.
• HIPAA: not in scope; we do not process Protected Health Information.
• GDPR / UK GDPR / FADP: we process Personal Data per these laws — see Privacy Policy and DPA above.
• CCPA / CPRA + state privacy laws: see Privacy Policy.
• OFAC / AML screening: we screen new customers against U.S. OFAC, EU, UK OFSI, and UN consolidated lists, and apply ongoing monitoring.