Book a demo
Menu
PlatformSolutionsServicesWhy Metadat-AIAboutNewsContact

Vulnerability Disclosure Policy

METADAT-AI LTD

Security Research Safe Harbour

Version 1.3
Effective Date October 2026
Owner Chief Executive Officer
Review Due Annually
Classification Public

1. Introduction

METADAT-AI LTD ("Metadat-AI") welcomes responsible security research. We believe that working collaboratively with the security research community helps protect our customers and makes our platform more secure for everyone. This Vulnerability Disclosure Policy ("VDP") describes how to report a security vulnerability to us and what you can expect from us in return.

This policy is aligned with NCSC guidance on vulnerability disclosure. We are a small company without a formal bug bounty programme, and we engage with researchers in good faith.

This policy is a publicly available policy. It does not form part of any contract with any customer, supplier, or other third party, and does not create any legally enforceable rights in favour of any person other than Metadat-AI. Metadat-AI may update this policy at any time by publishing a new version at the URL in clause 9.

2. Scope

This policy applies to vulnerabilities in:

  • Metadat-AI's platform and API: app.metadat.ai (production), search.metadat.ai (search) and dev.metadat.ai (development and demonstration environment).

  • Metadat-AI's primary website (www.metadat-ai.com).

  • The on-premise components of the Software that Metadat-AI supplies to customers for installation on their own infrastructure.

This policy does not apply to vulnerabilities in third-party services used by Metadat-AI. Please report those directly to the relevant vendor.

3. What We Ask of You

To qualify for the safe harbour described in clause 7, we ask that you:

  • Report the vulnerability to us promptly, before disclosing it to any third party or publicly.

  • Give us a reasonable time to assess and address the vulnerability (we ask for at least 90 days) before you disclose it publicly. Where we are making good-faith progress, we may ask for a reasonable extension.

  • Avoid accessing, modifying, copying, or deleting data that is not yours.

  • Do not exploit the vulnerability beyond what is necessary to demonstrate its existence.

  • Do not use social engineering, phishing, or physical attacks against our staff, customers, or infrastructure.

  • Do not conduct denial-of-service attacks or send unsolicited bulk messages through our systems.

  • Do not use automated scanning tools against our infrastructure without prior written permission.

4. What Is Out of Scope

The following are generally out of scope and need not be reported:

  • Missing security headers that do not directly lead to a vulnerability.

  • Email security issues (DMARC, DKIM, SPF) unless they lead to a demonstrable attack.

  • Self-XSS or issues that require significant user interaction to exploit.

  • Rate-limiting issues unless they demonstrably lead to account takeover or data exposure.

  • Information disclosure of non-sensitive data (e.g. software version numbers).

  • Issues in third-party services or products not maintained by Metadat-AI.

We also ask you not to test against our live production platform in a way that could affect real customer data. If you need a test environment, please contact us first.

5. How to Report

Please report vulnerabilities by email to security@metadat-ai.com. This address is also published in our security.txt file at www.metadat-ai.com/.well-known/security.txt. Your report should include:

  • A description of the vulnerability and the potential impact.

  • Steps to reproduce the vulnerability.

  • Any proof-of-concept code, screenshots, or supporting evidence.

  • Your preferred method of contact for follow-up questions.

6. What You Can Expect from Us

Once we receive your report, we will endeavour to:

  • Acknowledge receipt (we aim to acknowledge within 5 business days).

  • Provide an initial assessment of severity and whether the report is in scope (we aim to do so within 15 business days of receipt).

  • Keep you informed of our progress and estimated resolution timeline where we are able to do so.

  • Notify you when the vulnerability has been resolved.

All timelines in this policy are targets, not commitments.

We do not currently offer financial rewards for vulnerability reports. We are grateful for responsible disclosure and will, with your permission, acknowledge researchers who report valid vulnerabilities.

7. Legal Safe Harbour

Metadat-AI will not bring legal action or make a criminal complaint against security researchers who:

  • Comply with this policy in good faith.

  • Report the vulnerability to us promptly and give us a reasonable opportunity to address it before public disclosure.

  • Do not access, modify, or delete data belonging to other users.

  • Do not cause harm to our customers, employees, or systems.

This safe harbour applies to good-faith research conducted in accordance with this policy. It does not extend to malicious or wilful exploitation, or to activities that breach applicable criminal law regardless of intent. If you are uncertain whether a proposed research activity is within scope, please contact us before proceeding.

8. Regulatory Reporting Obligations

We may be legally required to notify regulators or other authorities about a vulnerability before a coordinated disclosure period ends; if so, we will tell you.

9. Contact

Email: security@metadat-ai.com

URL: www.metadat-ai.com/legal/policies/vdp