VurtuoLabs takes a risk-based approach to protecting its website, business systems, and information entrusted under client agreements. This page provides a public reporting channel for suspected vulnerabilities. It does not disclose confidential security architecture, guarantee that a system is invulnerable, create a bug-bounty program, or modify any client contract.
1. Security approach
Limit collection and access to information reasonably necessary for business and service purposes.
Use role-based or least-privilege access practices, authentication controls, and separation of client environments where appropriate.
Use encryption in transit, supported hosting platforms, secure configuration, logging, backup, change management, and vendor review appropriate to risk.
Evaluate security and data controls during architecture and delivery, including permissions, tool boundaries, human approvals, monitoring, and failure handling for AI and automation systems.
Maintain incident-response procedures for triage, containment, investigation, recovery, documentation, client coordination, and legally required notices.
2. Reporting a vulnerability
Email info@vurtuolabs.com with the subject “Security Report.” Include the affected URL or asset, vulnerability type, clear reproduction steps, impact, supporting requests or screenshots with secrets removed, and a safe method to contact you. Encrypt highly sensitive details or request a secure exchange method before sending them.
3. Good-faith research guidelines
Test only public VurtuoLabs assets that you are authorized to access and stop immediately if you encounter personal data, confidential information, credentials, or evidence of compromise.
Use the minimum testing necessary to confirm a finding. Do not alter, download, retain, exfiltrate, or disclose data beyond what is essential to demonstrate impact.
Do not perform denial-of-service testing, destructive testing, social engineering, phishing, physical attacks, spam, credential stuffing, password spraying, malware deployment, persistence, or attacks on employees, clients, vendors, or third parties.
Do not access client environments, production integrations, private repositories, third-party services, or accounts that are not expressly in scope.
Allow reasonable time for investigation and remediation before public disclosure and coordinate the timing and content of any disclosure with us.
4. Our response
We will make reasonable efforts to acknowledge a complete, credible report, evaluate severity, request additional information where needed, and communicate material progress. Response and remediation time depend on complexity, impact, affected providers, client coordination, and legal obligations. We do not promise payment, public credit, or a specific remediation date.
5. Safe-harbor intent
If you conduct research in good faith, comply with this policy, avoid privacy and operational harm, and promptly report the issue, VurtuoLabs does not intend to pursue legal action solely for the authorized research. This statement does not bind third parties, excuse violations of law, authorize access to systems we do not own, waive legal rights, or protect activity that is coercive, reckless, deceptive, extortionate, or outside this policy.
6. Security incidents and breach notice
A suspected weakness is not necessarily a legally reportable breach. If an incident occurs, VurtuoLabs will assess scope, information involved, risk, contractual duties, and applicable law. Where notice is required, we will notify affected parties and regulators in the legally required manner and timeframe. Texas law may require notice to affected residents without unreasonable delay and, when applicable, within 60 days after determining a qualifying breach occurred, subject to statutory exceptions.
7. Client environments
Security responsibilities for client work are allocated through the applicable agreement, architecture, access model, and client instructions. Clients remain responsible for decisions and controls assigned to them, including account administration, identity providers, data classification, user permissions, production approvals, lawful instructions, and operation after handoff unless a signed agreement states otherwise.
8. No warranty
Security information on this page is general and may change. It is not a certification, audit opinion, guarantee, representation about a specific client environment, or substitute for a signed security exhibit. No system, control, provider, or process can eliminate all risk.
9. Contact
Security reports: info@vurtuolabs.com with the subject “Security Report.” Other privacy matters should use the process in the Privacy Policy.