Security and Responsible Disclosure

1. How we protect the platform

• All connections use modern encryption (HTTPS/TLS). Stored data is encrypted.
• Each business's data is separated, and access is checked on every request.
• Passwords are not needed for most sign-ins; one-time codes and secure tokens are used instead. Team accounts can require two-step sign-in.
• Secrets such as connected-account tokens and site credentials are stored encrypted and never shown again after saving.
• Our staff use strong authentication and only access customer data when needed to help that customer or keep the service safe, with access logged.
• We back up data regularly to separate locations and test restoration.
• Code changes are reviewed and tested, dependencies are monitored for known vulnerabilities, and independent testing is carried out periodically.
• Websites we host are protected by a content delivery network with attack filtering and automatic certificates.

2. Your part

Keep your phone number and email secure, remove team members who leave, review connected accounts from time to time, and tell us immediately if you suspect someone else has access to your account. Never share one-time codes with anyone, including people claiming to be from ADigitalMotive; our staff will never ask for them.

3. Reporting a vulnerability

If you believe you have found a security vulnerability in ADigitalMotive, please email support@adigitalmotive.com with a description, the steps to reproduce it and its potential impact. Please:

• give us reasonable time to fix the issue before telling anyone else;
• avoid accessing, changing or deleting data that is not yours, and stop as soon as you confirm the issue;
• do not run denial-of-service tests, spam, social engineering or physical attacks;
• do not test against business websites without their owner's permission.

We will acknowledge your report within 3 working days, keep you informed, and credit you publicly if you wish once the issue is fixed. We will not take legal action against good-faith research that follows these rules.

4. Incidents

If a security incident affects your data, we will notify you without undue delay with what happened, what data is involved, what we are doing, and what you can do. Where the law requires, we will also notify the authorities.