Security and Vulnerability Reporting

Current scope

This page covers the static public Vortiek website. The Vortiek product and apps are prelaunch and do not currently accept accounts, payments, loyalty credentials, or travel records through this site.

Public-site safeguards

• HTTPS-only delivery with HTTP Strict Transport Security.
• A restrictive Content Security Policy with no inline script execution, plus referrer and permissions policies.
• No live public-site database, checkout, password login, or file upload.
• Identifier-free page-load aggregates retain only date, hour, broad device class, and country code, with no page path or visitor/session ID, and stop after rejection; raw IP and user-agent are not retained in aggregate storage. Detailed analytics is opt-in.
• Dependency, secret, and static-analysis checks run in continuous integration.

Incident response and breach notification

We maintain an internal incident response plan with severity tiers, a named incident owner and deputy, and defined escalation and communication steps. It is paired with a breach notification procedure that assigns the notification decision to an accountable owner and tracks the statutory notification deadlines that would apply by data type and location. The disclosure channel below is the public entry point into that process.

Attestation roadmap

No certification or third-party attestation is claimed today, and none should be inferred from this page. Our attestation path targets SOC 2 (Security, Availability, and Confidentiality) and is sequenced to product stages rather than calendar dates: control design mapped to the SOC 2 Trust Services Criteria during prelaunch, which is in progress through our internal compliance registers and release gates; an independent readiness assessment before the authenticated product accepts traveler data; a SOC 2 Type I report at commercial launch; and a SOC 2 Type II report after the first full observation window following launch. This section is updated as stages complete.

Report a vulnerability

Email contact@trunnion.ai with the affected URL, impact, reproducible steps, and contact information. Do not include active credentials, personal data, or destructive proof. We ask researchers to avoid privacy violations, service disruption, social engineering, and accessing more data than necessary.

We aim to acknowledge credible reports within five business days, provide a status update within ten business days, and coordinate remediation and disclosure based on severity. Good-faith research following these rules will not trigger legal action by us.