Vulnerability Disclosure Policy

Vulnerability Disclosure Policy

  1. Introduction

At Cimplifi, we take the security of our systems, data, and users seriously. We welcome feedback from security researchers and the public to help us improve our security posture. If you believe you have discovered a vulnerability, privacy issue, or other security exposure in a Cimplifi system, please report it to us in accordance with this policy.

  1. Guidelines & Safe Harbor

We ask that you give us a reasonable amount of time to investigate and remediate an issue before making any information public. If you conduct vulnerability research and report bugs in good faith compliance with this policy, we will:

  • Consider your research to be authorized conduct.
  • Work with you to understand and resolve the issue quickly.
  1. Reporting Channels

Please submit all security vulnerability reports directly to our security team.  We currently do not support PGP emails. Information submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities related to Cimplifi.  If your findings include newly discovered vulnerabilities that affect all users of a product or service and not solely Relativity, we may share your report with the Cybersecurity and Infrastructure Security Agency, where it will be handled under their coordinated vulnerability disclosure process. We will not share your name or contact information without express permission. Reports may be submitted anonymously.

Please include the following details in your report:

  • A description of the vulnerability and its potential impact.
  • Detailed steps to reproduce the issue (proof-of-concept scripts or screenshots are helpful).
  • The specific URL, endpoint, or system affected.
  • The potential impact of exploitation

Please also:

  • Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data
  • Write in English, if possible
  1. Strict Prohibitions

While we encourage security research, the following actions are strictly prohibited:

  • Any destructive testing, including Denial of Service (DoS/DDoS) attacks.
  • Accessing, modifying, or deleting data belonging to our users or clients.
  • Social engineering, phishing, or physical security attacks against Cimplifi employees or facilities.
  • Demanding financial compensation (extortion) in exchange for withholding details of a vulnerability.
  1. Our Commitment

If you report a vulnerability in compliance with this policy and share contact information, we will acknowledge receipt of your report within 3 business days.

Document change history

Version  Date                     Description

1.0          Sept 16 2026       Initial version