The purpose of this policy is to outline the procedures for reporting and addressing vulnerabilities in our products. This policy aims to ensure that our products are secure and protect the privacy of our customers.<\/p>\n\n\n\n
Reporting Process<\/strong><\/p>\n\n\n\n Security researchers or individuals who discover a vulnerability related to Brivo should contact us at security@brivo.com<\/a> to report the vulnerability. Brivo will acknowledge receipt of the report within 5 business days and confirm that we have received the report. Brivo will investigate the reported vulnerability and verify its existence and severity. Brivo will respond to the reporter with an update on the status of the investigation and any actions we are taking to address the vulnerability.<\/p>\n\n\n\n Brivo will review the disclosure and assess severity. Severity classification is at the sole discretion of the Brivo Engineering and Security Operations teams. Depending on the severity, a timeline to remediate will be assigned. Brivo will publicly disclose the vulnerability and the fix, once it has been implemented.<\/p>\n\n\n\n Brivo will maintain the confidentiality of the reporter\u2019s identity and any information provided during the disclosure process.<\/p>\n\n\n\n