Cogs processes sensitive business and accounting information. Cogs maintains administrative, technical, and organizational safeguards designed to protect the Service and Customer Data and improves those safeguards as the Service and risks evolve.
This page is a vulnerability-reporting policy. It is not a representation that Cogs holds a particular security certification or has completed a specific audit unless Cogs separately states that in writing.
Responsible Disclosure
If you believe you discovered a security vulnerability affecting Cogs, email legal@getcogs.ai with the subject Security Vulnerability and include enough information for Cogs to reproduce, assess, and investigate the issue.
Please include, where available:
- affected URL, endpoint, feature, or system;
- steps to reproduce;
- potential impact;
- relevant screenshots or request/response details with secrets removed; and
- a safe method for Cogs to contact you.
Research Guidelines
When investigating a potential vulnerability, please:
- test only accounts, organizations, systems, and data you own or have explicit authorization to test;
- avoid accessing, changing, downloading, retaining, or deleting data that is not yours;
- stop testing and notify Cogs promptly if you encounter another customer's data;
- avoid privacy violations, social engineering, phishing, physical attacks, spam, denial-of-service or load testing, and activity that materially degrades the Service;
- do not exfiltrate secrets or personal information to prove impact where a less intrusive proof is available;
- do not use a vulnerability to obtain money, data, access, or leverage; and
- allow Cogs a reasonable opportunity to investigate and remediate before public disclosure.
Nothing in this policy authorizes activity that violates applicable law or third-party rights.
What Cogs Will Do
Cogs will make reasonable efforts to acknowledge and investigate good-faith reports, prioritize issues based on risk, and communicate when additional information is needed. This policy does not create a contractual obligation to pay a bounty or reward.
Security Incidents Affecting Customers
Customers should promptly report suspected unauthorized access to their Cogs account. Where applicable law or contract requires notification of a qualifying security incident, Cogs will provide required notifications in accordance with those obligations.
Operator: Spear America LLC, 1021 E Lincolnway, Ste 6344, Cheyenne, Wyoming 82001, United States
Service: Cogs (GetCogs.ai)
Legal contact: legal@getcogs.ai