Information Security and Responsible Disclosure Policy
Security controls, customer responsibilities, vulnerability reporting and coordinated incident response.
Important. This document is part of the JASLYN NET service terms. It is written for operational use and should be read with any signed order, applicable service-specific agreement and mandatory law.
1. Security baseline
JASLYN NET is designed around tenant isolation, role-based access control, least privilege, audit logging, protected secrets, encrypted router credentials, controlled destructive actions, rate limiting and signed or authenticated integrations where supported.
2. Customer security obligations
- Use strong unique administrator credentials and available multi-factor authentication.
- Do not share API keys or router credentials through chat, tickets or source repositories.
- Restrict management access to trusted networks and approved administrators.
- Review audit records and revoke unused access.
- Report suspected compromise promptly.
- Maintain backups and recovery procedures for critical network configurations.
3. Responsible disclosure
Security researchers are encouraged to report suspected vulnerabilities privately through the official security/support channel. Reports should include affected URL or component, reproducible steps, impact, timestamps, and a safe proof of concept where appropriate.
Researchers must avoid accessing data that does not belong to them, destroying data, degrading availability, social engineering staff, or publicly disclosing an unpatched vulnerability before reasonable coordinated disclosure.
4. Incident response
The Company may isolate accounts, rotate credentials, disable integrations, preserve evidence, deploy mitigations and communicate with affected customers or regulators as required. Incident communications will distinguish confirmed facts from ongoing investigation.
5. No absolute guarantee
Security controls reduce risk but cannot eliminate all risk. Customers remain responsible for their own devices, networks, passwords, third-party integrations, subscriber endpoints and operational procedures.