Security and Vulnerability Reporting

Report a vulnerability

If you believe you found a security vulnerability in an Ampity-owned public website or service, email security@ampity.io. Include the affected URL or asset, steps to reproduce, potential impact, and supporting evidence. Encrypt sensitive details or ask us for a secure exchange method first.

Do not include client systems unless Ampity has explicitly confirmed that they are in scope.

Good-faith research

Keep testing limited to what is necessary to demonstrate the issue. Do not access, download, alter, retain, or disclose other people's data; disrupt availability; use social engineering; perform denial-of-service testing; plant malware; or attempt physical access.

What to expect

We will acknowledge a credible report, investigate it, and communicate when we can do so without increasing risk. Remediation timing depends on severity and complexity. We do not promise a reward or public credit unless agreed in writing.

Coordinated disclosure

Please allow reasonable time for investigation and remediation before publishing details. This page is not permission to test third-party services, client environments, employee accounts, or assets not clearly owned by Ampity.

How we approach security

Ampity uses proportionate administrative, technical, and organisational safeguards for its public website and business systems. No internet service is completely secure. Specific client security, incident, audit, and data-processing obligations are governed by the relevant signed agreement.