1. Overview

itemis SaaS services are online software applications that allow users to create, edit, manage, analyze and share digital content and artefacts, depending on the specific service used.

We recognize the vital role that independent security researchers, ethical hackers, and the broader cybersecurity community play in maintaining a secure software ecosystem.

This Vulnerability Disclosure Policy ("VDP") defines the guidelines under which you may discover, test, and report security vulnerabilities affecting itemis SaaS products and related services in a safe, ethical, and lawful manner.

2. Responsible Entity & Relationship

This Vulnerability Disclosure Policy establishes a formal framework and rules of engagement between any individual or organization conducting security testing or submitting a vulnerability report ("Researcher", "Reporter", or "you") and the itemis corporate entity responsible for the respective SaaS offering ("ITEMIS").

The applicable itemis entity granting safe harbor, receiving reports, and acting as your coordinating counterparty under this policy is determined by your habitual residence or principal place of business at the time the security research is performed or the report is submitted:

a) If your habitual residence or principal place of business is located in the United States of America:

itemis Inc.
150 North Michigan Avenue, 35th Floor
60601 Chicago
USA

b) If your habitual residence or principal place of business is located outside of the United States of America:

itemis AG
Speicherstraße 8
44147 Dortmund
Germany

The designated itemis entity serves as the sole party granting authorization and legal safe harbor under this policy and oversees the validation, triage, and remediation of submitted findings.

Regardless of the corporate entity determined above, all vulnerability findings, technical inquiries, and related security notices must be transmitted directly to our central Security Team at [email protected].

Matters concerning data protection, data subject inquiries, or contacts for our Data Protection Officer remain exclusively governed by the Privacy Policy for itemis SaaS and do not need to be addressed separately under this policy.

3. Safe Harbor & Legal Protection

If you conduct your security research in good faith and in full compliance with the terms of this policy:

  • Authorization: ITEMIS considers your research activities to be authorized, permitted, and lawful.

  • No Legal Action: ITEMIS will not initiate civil lawsuits or contact law enforcement regarding your testing activities.

  • Cooperation: ITEMIS will work with you constructively to understand, validate, and remediate the reported vulnerability.

If you inadvertently access personal data during your research, you must cease testing immediately and notify us. The processing of any personal data adheres strictly to the principles defined in the Privacy Policy for itemis SaaS.

4. Scope

4.1. In-Scope Assets

This policy applies exclusively to vulnerabilities discovered in:

  • All software-as-a-service applications and platforms provided under the itemis SaaS umbrella (including *.itemis.com and *.itemis.io endpoints hosting SaaS solutions).

  • Publicly accessible APIs and web services operated directly by ITEMIS in connection with itemis SaaS offerings.

4.2. Out-of-Scope Assets & Prohibited Methods

The following assets and testing methods are explicitly excluded from this policy:

  • Excluded Targets:

    • Third-party applications, plugins, or cloud infrastructure integrated with or linked from itemis SaaS that are not directly owned or operated by ITEMIS.

    • Customer-managed systems and networks outside the itemis SaaS perimeter.

  • Prohibited Testing Methods:

    • Denial of Service (DoS / DDoS) attacks or resource exhaustion testing.

    • Physical security attacks against ITEMIS offices, facilities, or data centers.

    • Social engineering attacks (e.g., phishing, vishing, pretexting) against ITEMIS employees, contractors, partners, or customers.

    • Automated mass scanning, high-frequency request generation, or brute-force attacks against authentication/login endpoints.

    • Modification, deletion, exfiltration, or destruction of customer data, proprietary assets, or system configurations.

5. Rules of Engagement & Researcher Conduct

To qualify for Safe Harbor (see section Section 3) and ensure research remains constructive, researchers must observe the following:

  1. Protect User & Customer Privacy: Do not read, download, store, alter, or share data belonging to customers or third parties. If sensitive data or personal data is encountered, abort testing immediately and report the exposure.

  2. Avoid Disruption: Ensure tests do not degrade platform performance, cause downtime, or interrupt operational workflows for other users.

  3. No Extortion or Ransom: Do not request payments, bug bounties under threat of disclosure, or attempt to extort ITEMIS or its users in any form.

  4. Coordinated Disclosure: Keep all details regarding vulnerabilities strictly confidential until ITEMIS has completed investigation and remediation, unless ITEMIS grants prior written consent to public disclosure.

  5. Applicable Laws: Always comply with applicable local, national, and international laws and regulations.

6. Vulnerability Reporting Process

6.1. Submission Channel

Please submit all vulnerability findings directly by email to: [email protected]

6.2. Submission Template / Required Information

To allow for swift triage, please provide a clear and concise report containing:

  • Vulnerability Category: (e.g., SQL Injection, Remote Code Execution, Authentication Bypass, Broken Access Control, XSS).

  • Target / Location: Exact URL, API endpoint, component, or parameter affected.

  • Reproduction Steps: Step-by-step instructions or a minimal, non-destructive Proof of Concept (PoC) illustrating the issue.

  • Impact Assessment: A realistic evaluation of the potential security risk and business impact.

  • Contact Details: Your contact details (handle, name, or email) for follow-up correspondence.

7. Response Timelines & Workflow

ITEMIS follows a structured response process upon receiving a security report:

Phase Target Timeline Description

Acknowledgment

Within 2 to 3 business days

Receipt confirmation and initial case identifier assignment.

Triage & Validation

Within 5 to 7 business days

Technical assessment, verification, and severity classification.

Remediation

Dependent on severity

Development, testing, and deployment of a fix or mitigating control.

Closure & Feedback

Upon deployment

Final notification to the researcher and coordinated closure.

8. Recognition

ITEMIS values researchers who take the time to responsibly disclose findings. While ITEMIS does not operate an open monetary bug bounty program by default, compliant and helpful contributions will be recognized by a formal letter of appreciation.

9. Policy Updates

ITEMIS reserves the right to modify or replace this Vulnerability Disclosure Policy at any time. Updates become effective upon publication on the designated legal portal.