Security and vulnerability reporting

This page describes in general terms how Vibhaga Group protects the data it holds, and how to tell us about a security weakness in the Dictate Safe App or the Website. It goes with section 14 of the Privacy Policy.

Part 1. How we protect data

1.1 What we do

• Connections between your browser or the App and our Website are encrypted.
• We store passwords in a protected form, not as plain text.
• Our team's access to customer records is limited by role, and our staff sign in with two-step verification.
• We limit repeated attempts to sign in.
• We keep regular backups of the Website's database.
• We keep records of changes that our team makes through our staff tools.
• The App checks that an update is signed by us before it installs it. It installs an update only when you agree.
• The Website runs on servers in India.

1.2 On your computer

The App keeps your recordings, text, History, notes and chats on your computer, and we do not receive them. You can switch on encryption of this data in the App, under Settings, Privacy. It is off until you turn it on. You hold the key. If you lose both the key and your recovery passphrase, nobody can open the data, including us. The App writes backups only to a folder you choose, and you choose whether to lock a backup with a passphrase. We recommend that you also keep your operating system's disk encryption switched on.

1.3 The limits of this page

This page is a general description. It is not a certification or an audit report, and no system is completely secure. If a personal data breach affects you, we will tell the people affected without undue delay and tell the authorities where the law requires it. Section 14 of the Privacy Policy says more.

Part 2. Reporting a vulnerability

2.1 Where to send it

Email security@dictatesafe.com. The same address is in our machine-readable file at /.well-known/security.txt.

2.2 What to include

• What you found and where: the App (with its version and your operating system) or the Website (with the page address).
• The steps to reproduce it and what someone could do with it.
• How to reach you.

Please do not send us other people's personal data.

2.3 What we do

• We confirm that we have your report within 5 working days.
• We keep you informed while we look into it and fix it, and we tell you when it is fixed.
• We fix a weakness in the App in a new version that reaches you through updates. We fix the Website as soon as practicable.

2.4 Disclosure

We ask you to keep the details private until we have fixed the weakness, or until 90 days have passed since your report, whichever comes first, unless we agree another date with you. Our target is to fix it within that time. If we need longer, we will tell you why and ask to agree a later date. If you want to be thanked by name, we may do so with your agreement. If you would rather stay private, we will keep your name private.

2.5 Rewards

We do not run a paid bug bounty. For a valid weakness that we did not already know about, we may, at our discretion, offer a free Dictate Safe Licence. Please do not ask for payment in return for the details.

2.6 Safe harbour

We consider research that follows this page to be authorised, and we will not bring legal action against you for it. If someone else takes action against you for research that followed this page, we will say that we authorised it. To stay within this page:

• act in good faith;
• do not destroy or change data, and do not look at other people's data beyond what you need to show the weakness;
• do not disrupt the App or the Website for anyone, and do not run denial-of-service or load tests;
• do not try to deceive our team or our customers (no phishing and no other social engineering);
• if you reach personal data, stop and report it to us.

This does not allow you to test services that other companies run.

2.7 What is out of scope

• Physical attacks, and spam.
• Services that other companies run, such as our payment provider, our email provider and the sign-in providers. Please report those to the company concerned.
• Weaknesses that need a computer that is already rooted or compromised.
• A missing best-practice setting, such as a header, that you cannot show has any effect.
• Reports from automated scanners that do not show how the problem could be used.

2.8 In scope

The Dictate Safe App for macOS and Windows, and the Website, including sign-in, the account area and the licence service.

Part 3. Contact and changes

Security reports: security@dictatesafe.com. Questions about your personal data: privacy@dictatesafe.com. When we change this page we update the version and date above.

Document history