Security documentation
Our security documentation, including our system description, the controls we operate, our subprocessor list and our compliance documentation, is available to customers and to prospects in an active evaluation. Email security@armorerlabs.com and tell us what you need. We send it under a mutual non-disclosure agreement, and we answer security questionnaires the same way.
Subprocessors
The providers that process customer data on our behalf are listed in the Data Protection Agreement each customer signs, and in the security documentation above. Customers receive at least 30 days' notice by email before a new provider begins processing their data.
Reporting a vulnerability
If you believe you have found a vulnerability in any Armorer system, software or repository, email security@armorerlabs.com. Include what you found and where, the steps to reproduce it, and any proof of concept.
- Do not access, modify or delete data that is not yours, and do not test against systems or installations you do not own.
- Do not run denial-of-service, spam or social-engineering tests.
- Give us reasonable time to remediate before disclosing publicly.
We acknowledge reports within 5 business days. Researchers who act in good faith and follow this policy will not face legal action from Armorer for their research. We do not offer a monetary reward at this time.
The machine-readable contact for security researchers is published at /.well-known/security.txt (RFC 9116).
Contact
Security questions go to security@armorerlabs.com.