Security Policy & Responsible Disclosure

If you discover a security vulnerability in any AltaCom system, website, or service, we ask that you report it to us responsibly before public disclosure.

Email your report to security.reporting@altacom.ca with a clear description of the issue, steps to reproduce it, and any relevant screenshots or proof-of-concept code. We treat all reports as confidential.

We will acknowledge receipt of your report within 2 business days.

We aim to provide an initial assessment within 5 business days and to resolve confirmed vulnerabilities within 30 days, depending on severity. We will keep you informed throughout the process.

Act in good faith. Do not access, modify, or delete data that does not belong to you. Do not perform denial-of-service attacks, spam, or social engineering against our staff or clients.

Give us reasonable time to respond before any public disclosure. We appreciate coordinated disclosure and will work with you to ensure issues are addressed before details become public.

We do not currently operate a paid bug bounty programme. However, we genuinely appreciate responsible researchers who help us improve our security posture.

With your permission, we are happy to acknowledge your contribution publicly once the issue has been resolved.

In scope: www.altacom.ca and any subdomain operated by AltaCom, the Payload CMS admin interface, and any public-facing API endpoints.

Out of scope: third-party services we use (Microsoft 365, Azure, DigitalOcean), social engineering attacks, physical security, and issues already known to us.

AltaCom will not pursue legal action against researchers who discover and report security vulnerabilities in good faith, in accordance with this policy.

We consider responsible security research to be a valuable contribution to the security community and to our clients.