Security Disclosure Policy

SECURITY DISCLOSURE POLICY InSpace Software Copyright (c) 2019-2026 InSpace Software. All rights reserved. This Security Disclosure Policy describes how security vulnerabilities related to our software products and other InSpace Software services should be reported and handled. Last updated: January 28, 2026 ------------------------------------------------------------ 1. COMPANY INFORMATION ------------------------------------------------------------ InSpace Software De Vechtborg 47 7772 WK Hardenberg The Netherlands Email: security@inspacesoftware.com Website: https://inspacesoftware.com Legal: https://inspacesoftware.com/legal ------------------------------------------------------------ 2. SCOPE ------------------------------------------------------------ This policy applies to all services, applications, and infrastructure operated by InSpace Software, including but not limited to the following domains: - inspacesoftware.com - inspacesoftware.net - ract.app - ract.dev - ract.sh - brickspace.app - inspacesync.com ------------------------------------------------------------ 3. RESPONSIBLE DISCLOSURE ------------------------------------------------------------ InSpace Software encourages the responsible disclosure of security vulnerabilities. Security researchers and other parties acting in good faith, who avoid privacy violations, data destruction, and service disruption, will not be subject to legal action under applicable laws for activities conducted in accordance with this policy. ------------------------------------------------------------ 4. REPORTING GUIDELINES ------------------------------------------------------------ Security issues should be reported via email to: security@inspacesoftware.com Reports should include sufficient information to allow the issue to be reproduced and evaluated, including where possible: - Affected systems or endpoints - Steps to reproduce the issue - Proof-of-concept details - Potential impact assessment Automated scanning, denial-of-service testing, or exploitation beyond a minimal proof-of-concept is strictly prohibited. ------------------------------------------------------------ 5. ENCRYPTED COMMUNICATION (PGP) ------------------------------------------------------------ Reporters may use encrypted email when submitting vulnerability reports. A public PGP key for security@inspacesoftware.com may be obtained via the canonical security contact file or upon request. PGP-Key: https://get.inspacesoftware.com/common/keys/inspacesoftware-security.pgp.asc PGP-Fingerprint: 57C22DB4725155F82BB55C69045DDFC71D2E0A74 ------------------------------------------------------------ 6. RESPONSE EXPECTATIONS ------------------------------------------------------------ We aim to acknowledge valid vulnerability reports within five (5) business days. Where appropriate, we will provide status updates during investigation and remediation. Resolution timelines may vary depending on severity, complexity, and operational impact. ------------------------------------------------------------ 7. BUG BOUNTY PROGRAM ------------------------------------------------------------ InSpace Software does not currently operate a bug bounty or monetary reward program. The absence of a bug bounty does not affect our commitment to addressing valid security reports submitted in accordance with this policy. ------------------------------------------------------------ 8. SAFE HARBOR ------------------------------------------------------------ Any activities conducted in accordance with this policy will be considered authorized. This policy does not grant permission for activities that violate applicable laws, compromise customer data, disrupt services, or exceed the scope of responsible disclosure. ------------------------------------------------------------ 9. CANONICAL SECURITY CONTACT ------------------------------------------------------------ The canonical location for our security contact information is: https://get.inspacesoftware.com/common/legal/inspacesoftware-security-discloser-policy.txt ------------------------------------------------------------ 10. CHANGES TO THIS POLICY ------------------------------------------------------------ This Security Disclosure Policy may be updated from time to time. Updates will be published via the legal section of our website. ------------------------------------------------------------ 11. ENTIRE AGREEMENT ------------------------------------------------------------ This policy forms part of the legal framework governing the use of InSpace Software services, together with the Terms of Service, Privacy Policy, Cookie Policy, End User License Agreement, and Data Processing Addendum. If any provision of this policy is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect. ------------------------------------------------------------ END OF SECURITY DISCLOSURE POLICY ------------------------------------------------------------