Responsible Disclosure Policy

Why we publish this

We sell dedicated infrastructure to organisations that take security seriously. It would be inconsistent to do that without a clear, public way for someone to tell us when they find a problem in our own systems.

If you have found a security vulnerability affecting this website or our systems, we want to hear about it, and we will not pursue you for reporting it in good faith under this policy.

---

Scope

In scope

• www.aigpudatacenter.co.za and its subdomains
• Our public-facing email infrastructure
• Any other system we publicly identify as in scope

Out of scope

• Systems operated by our service providers, unless the issue is caused by our configuration of them. Report those to the provider concerned.
• Third-party services we merely link to
• Social engineering of our staff, suppliers or customers
• Physical attacks against our premises or personnel
• Denial-of-service testing, load testing, or anything that degrades availability for others
• Automated scanning that generates high request volumes
• Findings from automated tools without a demonstrated, exploitable impact
• Reports that consist only of a missing best-practice header or a version banner, with no demonstrated impact
• Spam, phishing or issues in email deliverability configuration that carry no security impact

---

How to report

Email security@aigpudatacenter.co.za.

Please include:

• What you found, and where — the URL, endpoint or system
• How to reproduce it, step by step
• What an attacker could do with it
• Any proof-of-concept material, logs or screenshots
• How you would like to be credited, if you would like to be

Write in English or Afrikaans. One issue per report, please.

If you would like to encrypt your report, ask us and we will arrange a secure channel.

---

What we ask of you

• Report promptly after discovering the issue.
• Give us reasonable time to fix it before disclosing it publicly or to anyone else. We suggest 90 days from our acknowledgement, and we will keep you updated. If we need longer, we will explain why.
• Use only your own accounts and test data. Do not access, modify, download or delete anyone else's data.
• Access the minimum necessary to demonstrate the issue, and stop as soon as you have. If you encounter personal information, stop, do not retain a copy, and tell us immediately.
• Do not degrade the service. No denial-of-service, no destructive testing, no high-volume automated scanning, no spam.
• Do not use the finding for any other purpose — not extortion, not resale, not competitive advantage.
• Keep the report confidential until we have agreed on disclosure.
• Comply with the law.

---

What we commit to

• We will acknowledge your report within 3 business days.
• We will give you an initial assessment within 10 business days, telling you whether we have reproduced the issue and how we are treating it.
• We will keep you updated on remediation at reasonable intervals until the issue is resolved.
• We will tell you when it is fixed, and agree with you on disclosure.
• We will credit you if you would like credit and the report was valid. If you would prefer to stay anonymous, we will respect that.
• We will not take legal action against you — and will not support action by others — in respect of good-faith research conducted within this policy. If a third party brings action against you for research conducted in compliance with this policy, we will make it known that your actions were authorised.

We do not currently operate a paid bug bounty programme, and we do not offer monetary rewards. We say this up front so that nobody invests time expecting one.

---

If you go outside this policy

Activity falling outside this policy — accessing other people's data, degrading the service, extortion, or public disclosure without notice — is not authorised. Unauthorised access to a computer system, and the unlawful interception or interference with data, are offences under the Cybercrimes Act 19 of 2020. We reserve all rights in respect of activity outside this policy.

If you are unsure whether something is in scope, ask before you test. We would rather answer the question.

---

Our own obligations

If a vulnerability has led to a compromise of personal information, we will notify the Information Regulator and the affected data subjects as required by section 22 of the Protection of Personal Information Act 4 of 2013. Our Privacy Notice sets out how we handle security compromises.

---

Contact

AI GPU Data Center (Pty) Ltd 5 Rhodes Street, Kensington B, Randburg, 2195, South Africa Security reports: security@aigpudatacenter.co.za General: chris.mostert@aigpudatacenter.co.za · 082 465 1328

---