Responsible Disclosure & Compliance
Security Vulnerability Policy & Corporate Ethics Standards • Effective October 2026
Safe Harbor Protection for Security Researchers
ARAVANTA TECH values the contributions of the global cybersecurity research community. If you conduct vulnerability research in good faith and adhere to the guidelines set out below, we commit not to pursue legal action against you and to work cooperatively to remediate the identified issue.
1. Vulnerability Reporting Guidelines
To maintain Safe Harbor protection, researchers must comply with the following principles:
- Prompt Disclosure: Notify us as soon as possible after discovering a potential security vulnerability.
- No Data Access or Exfiltration: Do not view, download, modify, or destroy client data, personal records, or proprietary source code beyond what is strictly necessary to demonstrate proof-of-concept.
- No Denial of Service: Do not execute Distributed Denial of Service (DDoS), resource exhaustion attacks, or spam automated forms.
- Coordinated Disclosure: Provide us a reasonable window (minimum 60 calendar days) to remediate the vulnerability before publicly disclosing details.
How to Transmit a Security Report
Transmit your vulnerability reports directly to our security engineering team at:
Please include: description of the finding, reproduction steps with curl/HTTP request traces, potential impact assessment, and your contact info. We acknowledge valid reports within 48 business hours.
2. Anti-Corruption & Corporate Ethics
ARAVANTA TECH conducts all operations with integrity, zero tolerance for bribery, and adherence to international fair competition practices:
- Strict prohibition of improper payments, kickbacks, or facilitation fees in all jurisdictions.
- Compliance with the United States Foreign Corrupt Practices Act (FCPA) and UK Bribery Act.
- Thorough due diligence performed on all subcontractors, cloud vendors, and technical partners.
- Clear conflict-of-interest disclosure requirements for all principal architects and engineers.
3. Trade Sanctions & Export Compliance
Our software solutions, architectural consulting, and Aravanta CloudOS platform comply with applicable international trade sanctions and dual-use software export control regulations. We do not provide technology services to individuals or entities on designated restricted parties lists.
4. Intellectual Property & Open Source Governance
We maintain strict hygiene regarding open-source licensing (MIT, Apache 2.0, BSD). We guarantee that client proprietary software remains strictly isolated from restrictive copyleft regimes (GPL/AGPL) unless explicitly approved in writing by the client.