Security

How we protect data

• Every operator's data is kept separate and every request is checked against the signed-in company.
• Data is encrypted in transit (TLS) and at rest by our hosting providers.
• Card details never touch our servers: payments use the processor's tokens.
• Uploaded documents are private and open only through short-lived signed links.
• Limozly staff reach an operator's account only through an access grant the operator controls, read only by default, and every visit is logged.

The companies that process data for us are listed on Subprocessors.

Vulnerability disclosure policy

If you believe you have found a security vulnerability in Limozly, please report it through the vulnerability report form. We acknowledge reports within 3 business days and keep you informed until the issue is resolved.

In scope

The Limozly application, its APIs and the limozly.com website.

Please do not

• Access, change or delete data that is not yours; use a test account and stop as soon as you reach someone else's data.
• Run denial-of-service tests, spam, social engineering or physical attacks.
• Test operator WebSuite sites on their own domains, or third-party services we use.
• Make the issue public before we have fixed it.

Safe harbor

When you research and report in good faith and within this policy, we consider your work authorized, we will not pursue or support legal action against you for it, and we will work with you to understand and fix the issue quickly. If a third party takes legal action over research done within this policy, we will make it known that your work was authorized.