Vulnerability Disclosure Policy

How to report

Email security@pindrop.it with enough detail for us to reproduce the issue. A short description, the steps you took, the affected URL or endpoint, and what you were able to access or do is usually enough. Screenshots or a short recording help.

We will acknowledge your report within three working days and tell you what we intend to do about it. We will keep you posted while we work on a fix and let you know when it is resolved.

We do not run a paid bug bounty. We are a small team and we would rather say so than imply a reward we do not offer. We are happy to credit you publicly if you would like that.

What is in scope

• pindrop.it
• web.pindrop.it
• The Pin Drop apps for iOS and Android
• The Pin Drop API
• The Pin Drop browser extension

What is out of scope

These are either outside our control or already known, so a report about them is unlikely to be actionable:

• Services run by third parties, including the providers listed on our subprocessors page
• Denial of service, volumetric testing and anything that degrades the service for other people
• Social engineering of our team, our customers or our suppliers, and any physical attack
• Reports generated by an automated scanner with no demonstrated impact
• Missing security headers, cookie flags, or TLS configuration preferences with no working exploit
• Vulnerabilities requiring a rooted or jailbroken device, or a physically compromised device
• Email configuration findings such as SPF, DKIM and DMARC, unless you can show a working spoof
• Outdated browsers or libraries with no demonstrated path to exploitation

What we ask of you

• Give us a reasonable opportunity to fix the issue before you tell anyone else. We suggest 90 days, and we will usually be much quicker.
• Use only your own accounts and test data. Do not access, modify or keep anyone else’s personal data.
• If you do come across personal data, stop, and tell us what you saw so we can assess it. Do not download or retain it.
• Do not degrade the service for other people, and do not run destructive tests.
• Stay within the scope above and within the law.

Our commitment to you

If you follow this policy, we will treat your report as an authorised contribution to the security of the service. We will not bring a claim against you, we will not report you to the authorities for your research, and if a third party brings an action against you for work done under this policy we will make it clear that you were acting with our permission.

This policy does not give you permission to act in ways that break the law, and it cannot bind anyone other than Salucia Ltd.

Our security posture

Pin Drop is not certified to ISO 27001 or SOC 2, and we would rather say so plainly. The Pin Drop web application and API were assessed independently by Claranet Cyber Security in December 2025, and the letter of attestation is available on request. More detail is on our compliance page.

Contact

Security reports: security@pindrop.it
Data protection and legal: legal@pindrop.it
Salucia Ltd, 35 Ballards Lane, London, N3 1XW, United Kingdom

Our machine-readable contact details are published at pindrop.it/.well-known/security.txt in line with RFC 9116.