Information Security and Quality

Responsible Disclosure

At Index Software B.V., we consider the security of our systems to be of great importance. Despite our efforts to secure our systems, vulnerabilities may still occur.

We kindly ask you to:

• Report your findings by emailing info@index.nl

• Not exploit the vulnerability, for example by downloading more data than necessary to demonstrate the issue, or by accessing, deleting, or modifying data belonging to others

• Not share the issue with others until it has been resolved, and to delete any confidential data obtained through the vulnerability immediately after it has been fixed

• Refrain from using attacks on physical security, social engineering, distributed denial of service, spam, or third-party applications

• Provide sufficient information to reproduce the issue so we can resolve it as quickly as possible. In most cases, the IP address or URL of the affected system and a description of the vulnerability are sufficient, but more complex vulnerabilities may require additional details

• Report your findings by emailing info@index.nl

What we promise:

• We will respond within 3 days with our assessment of the report and an expected resolution timeline

• If you have adhered to the above conditions, we will not take legal action against you regarding the report

• We will treat your report confidentially and will not share your personal information with third parties without your consent, unless required to comply with a legal obligation. Reporting under a pseudonym is possible

• We will keep you informed about the progress of resolving the issue