1. Our approach
KDFS applies layered safeguards suited to the services it operates. These may include encrypted web connections, secure configuration, multi-factor authentication, role-based access, tenant-aware separation, logging, monitoring, backups, patching, vulnerability review and incident response.
2. Hosting and service boundaries
KDFS uses reputable infrastructure and service providers. Product-specific hosting locations and data commitments are described on the relevant product’s Legal & Trust Centre or in customer agreements. A statement made for one product should not automatically be assumed to apply to every KDFS service.
3. External monitoring
We use operational and external security monitoring, including third-party security-rating information, to identify configuration weaknesses and emerging risks. Findings are assessed and remediated according to severity and practical risk.
4. Responsible vulnerability disclosure
If you believe you have discovered a security vulnerability affecting a KDFS-controlled system, report it privately and promptly. Include the affected hostname or service, a clear description, reproducible steps, potential impact and relevant evidence.
Email: [email protected]. If that mailbox has not yet been provisioned, use [email protected] with the subject “Private security report”.
5. Safe reporting expectations
- do not access, change, download or retain data that is not yours;
- do not disrupt services, perform denial-of-service testing or use destructive techniques;
- do not use social engineering, phishing or physical attacks;
- stop testing and report immediately if personal, confidential or customer information is encountered;
- allow reasonable time for investigation and remediation before public disclosure.
6. What to expect
We will seek to acknowledge a sufficiently detailed report, assess its validity and impact, and communicate material progress where practical. This page does not create a bug-bounty program or promise payment.
7. Security incidents
Customers and users should report suspected compromise, unintended disclosure or suspicious account activity through the relevant product support channel as soon as possible.