Security

Our approach

We design security and privacy into our software from the start. We build to the requirements of the frameworks below and assess our own work against them. These assessments are internal. They are not certifications, audits or attestations. If we obtain a certification or attestation, we will list it on this page with its date and issuing organization.

Frameworks we assess against:

• HIPAA Security Rule (45 CFR Part 164, Subpart C), with NIST SP 800-66, the NIST guide to implementing it
• AICPA Trust Services Criteria (the criteria used in SOC 2 reports)
• NIST Cybersecurity Framework and NIST SP 800-53
• NIST AI Risk Management Framework
• NIST SP 800-63B, for authentication
• ISO/IEC 27001 and ISO/IEC 27701
• HITRUST CSF
• OWASP Top 10
• WCAG 2.2 Level AA, for accessibility

We record the findings of each assessment and track each one to closure.

Our websites

We protect our websites with measures appropriate to the information they handle, including:

• encrypted connections only, with HTTP Strict Transport Security;
• signed DNS and limits on who may issue certificates for our domains;
• strict browser security policies that limit which sources may run code and that block framing by other sites;
• access to private previews protected so that their content cannot be read without the access we give;
• authenticated email from our domains; and
• a machine-readable security contact at /.well-known/security.txt.

Reporting a vulnerability

If you believe you have found a security vulnerability in our websites, our email domains or our software, please email info@navikindlabs.com with “Security” in the subject line. Include a description of the issue, the steps or proof of concept needed to reproduce it, the affected address or component, the potential impact and how we can reach you.

We aim to acknowledge reports within five business days, to keep you informed as we investigate and remediate, and to coordinate the timing of any public disclosure with you.

Guidelines

• Test only against systems you are authorized to test, and use only the access necessary to demonstrate the issue.
• Do not access, modify or delete data that is not yours. If you encounter personal information or other sensitive data, stop, report it to us, do not keep or share it, and delete any copies once you have reported it.
• Do not use a vulnerability to keep access, move to other systems or extract more data than needed to demonstrate the issue.
• Do not perform denial-of-service testing, automated scanning that degrades service, social engineering or physical testing.
• Keep the details of the issue confidential until we release a fix or 90 days have passed since your report, whichever is sooner, unless we agree on a different date with you.

Scope

In scope: our domains and their subdomains, the email authentication configuration of our domains, and any software we release. Out of scope: services operated by third parties, whose issues should be reported to those providers; reports from automated tools without a demonstrated security impact; and missing best-practice settings that cannot be exploited.

Safe harbor

If you make a good-faith effort to comply with this policy, we will consider your research authorized under the Computer Fraud and Abuse Act and similar state laws, and we will not pursue or support legal action against you related to it. We will not bring a claim against you under the Digital Millennium Copyright Act for circumventing technical measures in the course of that research, and we waive any restriction in our Terms of Use that would otherwise prohibit it. This authorization covers only in-scope systems that NaviKind Labs controls; we cannot authorize testing of systems operated by others. If a third party brings legal action against you for activities conducted under this policy, we will make it known that we authorized your actions. If you are unsure whether a test is consistent with this policy, email us before you proceed.

We do not offer monetary rewards at this time. With your permission, we will credit you for a valid report.