Security & Responsible Disclosure

Reporting a vulnerability

If you believe you have found a security issue in vantomicagentic.com or any Vantomic service, email info@vantomicagentic.com with the subject line "Security report". Please include what you found, the steps to reproduce it, the impact you believe it has, and how you would like to be credited.

We acknowledge reports within three business days, keep you updated while we investigate, and tell you when the issue is resolved. We do not currently run a paid bounty programme.

Safe harbour

We will not pursue legal action against researchers who act in good faith under this policy: report promptly, avoid privacy violations and service degradation, use only accounts you own or have permission to test, and give us reasonable time to fix the issue before disclosing it publicly.

Out of scope

• Findings from automated scanners without a demonstrated, practical impact.
• Denial-of-service, volumetric or physical testing.
• Social engineering of our staff, customers or suppliers.
• Missing best-practice headers or configuration with no demonstrated exploit path.
• Any testing against a customer's own deployment — those are operated by the customer and must be coordinated with them.

How our products are designed

These are design commitments for our software, not a certification claim. We hold no third-party audit or certification at this time; if that changes, we will say so here.

• Integrations are read-only and one-way: we ingest exports, and open no inbound pathway into a plant system.
• Products are advisory and non-safety-related, and are never a credited input to a plant decision.
• Deployments run inside the customer's own tenant or environment; the customer holds the keys and the data.