Security Policy

1. Purpose

Zechion takes the security of its corporate website and business information seriously. This policy explains how to report a potential security vulnerability affecting the Zechion website at https://zechion.com/.

Our goal is to receive relevant security reports, assess potential risks, and consider appropriate corrective measures.

2. Scope

This policy applies to the publicly accessible corporate website operated by Zechion, to the extent that the relevant website components are under our control.

It does not automatically apply to subsidiary websites, customer systems, third-party platforms, vendor infrastructure, or other systems that Zechion does not own or administer.

Reports involving a subsidiary's website should be directed through that subsidiary's published contact channel where available.

3. Reporting a Potential Vulnerability

If you believe you have identified a security vulnerability affecting the Zechion website, please report it through the designated corporate security contact below.

Security Contact: info@zechion.com

Please include, where possible:

A concise description of the suspected vulnerability.
The affected webpage, URL, or component.
The potential security impact.
Steps to reproduce the issue using information obtained lawfully.
Relevant screenshots, logs, or other non-sensitive evidence.

Please do not include passwords, access tokens, payment details, personal records, or other sensitive information unless it is strictly necessary and an appropriate secure submission method has been provided.

4. Responsible Testing

Anyone investigating a potential vulnerability should act responsibly and limit testing to what is necessary to demonstrate the reported issue.

Please do not:

Access, copy, modify, delete, or disclose another person's data.
Attempt to obtain unauthorized access to accounts, systems, or restricted information.
Disrupt website availability or interfere with normal operations.
Conduct denial-of-service testing, destructive testing, or tests that could impair systems.
Use phishing, social engineering, malware, or other harmful techniques.
Publicly disclose unremediated vulnerabilities or sensitive technical details before allowing a reasonable opportunity for assessment.

Do not continue testing once you have obtained sufficient evidence to describe the suspected issue.

5. Handling Reports

Zechion will review reports submitted through the designated channel and may request additional information to help assess the issue.

Depending on the report, we may investigate, prioritize remediation, seek assistance from relevant technical providers, or determine that the issue falls outside the scope of this policy.

We cannot guarantee a response time, a particular outcome, or that every reported issue will result in a change.

Please do not assume that submitting a report establishes a contract, creates a bug bounty arrangement, or authorizes testing beyond the applicable legal permissions.

6. Good-Faith Reporting

We appreciate good-faith efforts to report potential security issues. Reports should be made honestly, responsibly, and without accessing information or systems beyond the reporter's authorization.

This policy does not grant permission to access or test any system without authorization. It does not provide a blanket promise of immunity from legal action or waive any rights or obligations under applicable law.

7. Third-Party Systems

Some website features or infrastructure may be provided by hosting companies, software vendors, or other third parties. Zechion cannot independently authorize testing against systems owned or operated by those parties.

If a suspected vulnerability belongs to a third-party service, the relevant provider may need to be notified through its own security reporting process.

8. Confidentiality and Public Disclosure

Please avoid publicly sharing sensitive details of a suspected vulnerability before the issue has been assessed and there has been a reasonable opportunity to address it.

Any coordination, disclosure timeline, or confidentiality obligation must be agreed upon separately or arise under applicable law. This policy does not establish a formal coordinated vulnerability disclosure agreement.

9. No Bug Bounty Program

Unless Zechion separately announces a written program, this policy does not offer financial rewards, compensation, or other benefits for vulnerability reports.

Do not assume that testing expenses or other costs will be reimbursed.

10. Policy Updates

Zechion may update this policy as its website, security processes, or applicable requirements change. The latest version published on this page will display its effective or last-updated date.

11. Contact

For security reports concerning the Zechion corporate website:

Website: https://zechion.com/