1. How to report
Email support@recoverypilotai.com with the subject line “Security report.” Tell us which page, feature or service is affected, what you saw and when, the possible impact, and the fewest steps we need to reproduce it. Include how we can reach you.
2. Keep sensitive information out of the report
Do not include passwords, access tokens, API keys, payment details, Social Security numbers, consumer account details or another organization’s data. If we cannot understand the report without sensitive evidence, describe the evidence and ask us how to share it securely.
3. Acceptable research conduct
- Use only accounts and workspaces you are authorized to use, and stay within that access.
- Do not view, copy, change or delete information that belongs to RecoveryPilot customers, their employees or consumers. If you come across it by accident, stop, do not keep or share it, and tell us where and how it happened.
- Do not run denial of service tests, high volume automated scans, social engineering, phishing, physical attacks or credential attacks.
- Do not send messages, place calls, make payments or start customer workflows to demonstrate a concern.
4. Scope
This policy applies to websites and the hosted platform operated by RecoveryPilot. It does not authorize testing of third-party providers, payment processors, telephone or messaging services, or systems run by RecoveryPilot customers. Testing beyond normal authorized use needs our written approval first.
5. Coordinated disclosure
Please give us a reasonable chance to investigate and fix a problem before you discuss technical details publicly, and never publish credentials or personal information. We may contact you for more detail. This policy does not promise a particular response time, payment, reward or public acknowledgment.
6. Related policies
Our Privacy Policy explains how we handle information, our Terms of Service govern use of this website, and the Trust Center summarizes our security practices and shared responsibilities.