Start free
Menu
FeaturesPricingPrivacyCompareInstallDocsDashboardLog in
Legal documents · Report a vulnerability

Legal › Security

Responsible disclosure

Version 1.0 · Last updated 25 October 2026

Found a security problem in Nvivio? How to report it, what we ask of you, and what you can expect from us.

In short. Email security@nvivio.com. Do not look at or change data that is not yours, and give us time to fix it. We answer within five working days and will not take legal action against you if you follow this policy.

1. How to report

Write to security@nvivio.com, in English or Dutch. Describe:

  • what you found and where (the address, the endpoint or the part of the script);
  • the steps to reproduce it, and what an attacker could do with it;
  • how we can reach you, and whether you want to be named when it is fixed.

Our security.txt lists the same contact.

2. In scope

  • nvivio.com, including the dashboard at /app and the API at /v1;
  • nviv.io, the script and the collection of events;
  • mcp.nvivio.com, the MCP server;
  • admin.nvivio.com, our administration (only whether it can be reached without permission).

Out of scope: our providers themselves (Cloudflare, Supabase, Amazon Web Services; report to them), reports from automated scanners without a demonstrated impact, missing best practices without a concrete risk, and denial-of-service.

3. What we ask of you

  • Only do what is needed to show the problem. Do not access, copy, change or delete data of others; if you come across it anyway, stop, tell us, and delete what you have.
  • Use your own account and sites to test. Do not use social engineering or phishing, do not test physical security, and do not send spam.
  • Do not overload or disrupt the service.
  • Keep the problem to yourself until we have fixed it, and agree with us when you publish. We aim to fix serious problems within 90 days.

4. What you can expect from us

  • We confirm your report within five working days and tell you how we assess it.
  • We keep you informed while we fix it, and tell you when it is fixed.
  • If you followed this policy, we will not take legal action against you or report you to the police for your research.
  • With your permission, we thank you by name once the problem is fixed. We do not offer a bug bounty at the moment.

Belgian law offers a legal framework for reporting vulnerabilities in good faith through the Centre for Cybersecurity Belgium (CCB). You may also report through the CCB, at ccb.belgium.be; this policy does not take away any protection that framework gives you.

Versions

  • 1.0, 25 October 2026: first version.

All legal documents