Vulnerability Disclosure Policy

CaseEasy 360 – operated by Aubyn Innovations Inc.

1. Purpose and Scope

1.1 Our commitment. CaseEasy 360 is a practice management platform operated by Aubyn Innovations Inc. ("CaseEasy", "we", "us"). Protecting our customers' information and maintaining the security of our services are important priorities.

1.2 Security program. We maintain an established vulnerability management program and engage independent security professionals to conduct authorized security assessments, penetration testing and ongoing vulnerability monitoring.

1.3 Scope. This Policy applies to CaseEasy websites, applications, APIs, infrastructure and associated services.

2. No Public Bug Bounty Program

2.1 No compensation. CaseEasy does not operate a public bug bounty program or paid vulnerability disclosure program. We do not offer financial compensation, rewards or other incentives for unsolicited vulnerability reports, regardless of their severity, validity or potential impact.

2.2 No implied agreement. Submitting a vulnerability report does not establish a contractual relationship, create an entitlement to compensation or obligate CaseEasy to provide individual feedback, recognition or remuneration.

2.3 Independent assessments. Security assessments and penetration testing are conducted through our established security program and authorized service providers. We are not accepting unsolicited offers for security testing or vulnerability assessment services.

3. Unauthorized Security Testing

3.1 Prior authorization required. CaseEasy does not authorize independent security testing of its systems without prior written permission. The public availability of our websites, applications or APIs does not constitute authorization to conduct security assessments.

3.2 Prohibited activities. Without prior written authorization, individuals must not conduct penetration testing, automated vulnerability scanning, exploitation attempts, authentication bypass testing, denial-of-service testing or other intrusive security assessments.

3.3 Customer information. Individuals must not attempt to access, retrieve, modify, disclose or interfere with customer information, including confidential legal records, personal information or documents maintained within the platform.

3.4 No safe harbour. This Policy does not grant permission to conduct security testing or provide authorization for activities that would otherwise be prohibited by applicable law or our contractual terms.

4. Reporting Security Concerns

4.1 Reporting channel. If you become aware of a potential security vulnerability without conducting unauthorized testing, you may report the concern to [email protected].

4.2 Report contents. Where available, reports should include a description of the concern, the affected service and sufficient information for our security team to evaluate the potential impact. Do not include customer data, credentials or confidential information obtained without authorization.

4.3 Review process. Reports may be assessed through our established vulnerability management processes. CaseEasy retains discretion over the prioritization, investigation and remediation of reported concerns and does not guarantee individual responses or status updates.

4.4 No testing authorization. Submission of a report, acknowledgment of a concern or communication with our team does not constitute authorization to perform additional testing or validation.

5. Responsible Conduct

5.1 Respect for restrictions. We ask security researchers and third parties to respect our decision not to operate a public bug bounty program and to refrain from unsolicited security assessments.

5.2 Coordinated disclosure. If you believe you have identified a security vulnerability, please contact us before making technical details public to allow an opportunity for assessment and appropriate remediation.

5.3 Rights reserved. CaseEasy reserves its rights under applicable law and its contractual agreements concerning unauthorized access, testing or interference with its systems.

6. Policy Updates and Contact

6.1 Changes. We may update this Policy periodically to reflect changes in our security practices or operational requirements. The current version will be published on our website.

6.2 Contact. For legitimate security concerns, contact [email protected]. This contact channel does not constitute an invitation to perform independent security testing.

Last Updated: October 28, 2026