Security and Responsible Disclosure Policy

1. Our Security Commitment

Glypho takes user privacy, data protection, and platform integrity seriously. We implement industry-standard security measures, including:

• Encryption of data in transit
• Controlled access permissions
• Continuous monitoring for anomalies
• Regular security testing and assessments
• Secure development practices
• Isolation of sensitive components
• Logging and audit trails

While no system is perfectly secure, we strive to detect, prevent, and mitigate security threats.

2. Scope of This Policy

This policy applies to:

• The Glypho website
• Glypho mobile applications
• AI-powered platform features
• API endpoints (present or future)
• All publicly reachable assets under glypho.online

Out of scope (forbidden to test):

• Internal development systems
• Employee systems
• Third-party services not owned by Glypho
• Social engineering of staff or users

3. Responsible Disclosure Guidelines

If you discover a security vulnerability, we ask that you:

• Report it to us as soon as possible
• Give us reasonable time to investigate and resolve it
• Avoid disclosing the issue publicly before it is fixed
• Do not access or modify user data
• Do not disrupt platform services
• Follow all applicable laws

Glypho does not pursue legal action against researchers who follow these principles and act in good faith.

4. How to Report a Security Vulnerability

Please send security reports to:

info@glypho.online or support@golldy.com

Your report should include:

• Description of the issue
• Steps to reproduce
• Affected endpoints or components
• Proof of concept if available
• Your contact details for follow-up

We aim to acknowledge reports within a reasonable timeframe and keep you updated during the investigation.

5. What We Do When We Receive a Report

Upon receiving a vulnerability report:

• We review and validate the issue
• We assess its severity and potential impact
• We prioritize the fix based on risk
• We work toward remediation
• We may request additional details
• We notify the reporter once the issue is resolved

Glypho appreciates good-faith security research and the individuals who contribute to platform safety.

6. Prohibited Activities

Even during good-faith testing, the following are strictly prohibited:

• Accessing personal data of any user
• Attempting account takeover
• Attempting denial-of-service attacks
• Running automated scanners at high volume
• Uploading malware or harmful code
• Attempting to modify or delete data
• Exploiting vulnerabilities beyond minimal testing
• Publicly disclosing vulnerabilities before remediation

Violations may result in account termination or legal action if conducted in bad faith.

7. Safe Harbor

Glypho provides safe harbor protection for researchers who:

• Act in good faith
• Follow this policy
• Avoid harm to users or data
• Give us reasonable time to resolve issues

We will not pursue legal action against such researchers.

8. No Compensation Policy

At this stage, Glypho does not operate a bug bounty or paid vulnerability reporting program. We may acknowledge contributors privately or publicly at our discretion.

9. Security Best Practices for Users

Glypho encourages all users to:

• Use strong, unique passwords
• Enable device-level protections
• Keep browsers and operating systems updated
• Avoid clicking unknown links within content
• Report suspicious behavior or content

Security is a shared responsibility.

10. Updates to This Policy

Glypho may update this Security and Responsible Disclosure Policy from time to time to reflect technology changes, best practices, or compliance needs.

Continued use of the platform after updates constitutes acceptance of the revised policy.

11. Governing Law

This policy is governed by the laws of the State of Israel.

All disputes related to this policy fall under the exclusive jurisdiction of the competent courts of Tel Aviv, Israel.