Alvin Technologies, Ltd. (“Alvin,” “we,” “us” or “our”) takes the security of our systems and the information entrusted to us seriously. We welcome good-faith reports from security researchers and members of the public who believe they have identified a potential security vulnerability affecting an Alvin website, application or service.

This policy explains how to report a suspected vulnerability, what security research is permitted and what you can expect from Alvin after submitting a report.

Security priorities for institutional deployments. Alvin’s security priorities include segregation of delegation and customer information, role-scoped access, confidentiality of sensitive documents and communications, revocable and attributable permissions, auditable sensitive actions and incident-response preparedness. Specific controls and notification commitments depend on the service scope and applicable customer agreement.

1. How to report a vulnerability

Please send suspected security vulnerabilities to the address below. If delivery fails, use hello@alvin.finance as a fallback:

security@alvin.finance

Use the subject line:

Security vulnerability report

Your report should include enough information for us to understand and reproduce the issue. Please identify the affected website, application, page, endpoint or feature, explain the nature and potential impact of the vulnerability and provide clear steps for reproducing it.

Where helpful, you may also include screenshots, logs, relevant request and response details, limited proof-of-concept code and any suggested remediation. Please remove or redact unnecessary personal information, credentials and confidential customer information before submitting your report.

Do not include exploit code or sensitive data beyond what is reasonably necessary to demonstrate the issue.

2. Systems covered by this policy

Alvin welcomes reports of suspected vulnerabilities affecting its websites, applications and services. Listing a service below is not permission to test it. Without separate written authorization from Alvin, permitted activity is limited to passive, non-disruptive review of public Alvin website content, public DNS records and certificate-transparency information, together with issues encountered during legitimate, authorized use. The following names help identify services relevant to a report; they do not establish a blanket testing scope:

• alvin.finance — public website and public DNS/certificate records (passive review only)

• portal.alvin.finance — vulnerability reports welcome; active testing requires prior written authorization

• Alvin Envoy — vulnerability reports welcome; active testing requires prior written authorization

• Alvin Travel — vulnerability reports welcome; active testing requires prior written authorization

• Other Alvin-operated services — vulnerability reports welcome; active testing requires prior written authorization

Active scanning, probing, enumeration or other security testing of authenticated applications, APIs, customer workspaces, production workflows, supplier integrations, non-public assets or any service beyond the limited activity described above requires Alvin’s prior express written authorization identifying the specific systems, methods and safeguards. Reports about other Alvin-operated services are welcome, but reporting eligibility does not expand testing authorization.

Third-party systems, suppliers, travel platforms, banks, payment providers, infrastructure providers, communications providers and other services that Alvin does not control are outside the scope of this policy, even where they are linked to or integrated with an Alvin service.

Where a vulnerability affecting a third-party provider could materially affect Alvin customers or services, you may notify us in addition to reporting the issue to the relevant provider.

3. Permitted security research

Good-faith security research aims to identify and responsibly report a potential vulnerability using the least intrusive method reasonably available while avoiding harm. You may report any suspected Alvin vulnerability, including an issue discovered during normal authorized use, without attempting further testing.

Use only information, accounts and systems that you own or are expressly authorized to access. Respect user privacy, avoid collecting unnecessary information and stop immediately if you encounter another person’s data, unexpected elevated access or a risk to service availability. Share only the minimum evidence necessary to describe the issue.

Automated scanning, fuzzing, enumeration, bulk requests, rate-limit testing, API probing and other active security tests are not authorized unless Alvin has approved the specific scope and safeguards in writing beforehand.

4. Prohibited activity

This policy does not authorize activity that could harm Alvin, our customers, users, partners, suppliers or other parties.

You must not intentionally access, download, alter, delete, retain, transmit or disclose personal information, customer information or confidential information that you are not authorized to access.

You must not conduct denial-of-service testing, distributed denial-of-service testing, load testing, stress testing or any other activity that could degrade, interrupt or impair an Alvin service.

You must not use social engineering, phishing, credential theft, physical intrusion, employee impersonation or attacks directed at Alvin personnel, customers, users, suppliers or partners.

You must not introduce malware, ransomware, destructive code, persistent access mechanisms or backdoors.

You must not alter production data, permissions or configurations, trigger transactions, communications or other real-world actions, or interfere with customer or supplier operations without express authorization.

You must not exploit a vulnerability beyond the minimum extent reasonably necessary to confirm its existence and explain its potential impact.

You must not publicly disclose a suspected vulnerability before Alvin has had a reasonable opportunity to investigate and address it.

5. Sensitive information encountered during research

If you encounter personal information, payment information, credentials, passport information, travel records, confidential customer information or other sensitive data, stop testing immediately.

Do not copy, download, retain, transmit, disclose or otherwise use the information except to the minimum extent necessary to notify Alvin that exposure occurred.

Your report should describe the type of information encountered without including the information itself unless Alvin specifically requests a limited sample through an agreed secure method.

Any sensitive information inadvertently retained during testing should be securely deleted after Alvin confirms receipt of the report, unless preservation is legally required.

6. Safe harbor

Alvin will not initiate civil legal action solely for good-faith security research on Alvin-controlled assets that is expressly authorized by this policy or by separate written permission and complies with the applicable restrictions.

To qualify for this safe harbor, researchers must remain within the authorized scope, avoid disruption and harm, respect privacy, stop when unauthorized information or access is encountered and promptly report the issue without retaining or disclosing sensitive data.

Security research meeting these conditions is considered authorized solely to identify and report a potential vulnerability. Reporting an issue does not retroactively authorize otherwise prohibited testing or access.

This commitment cannot bind third parties or override applicable law. It does not apply to unauthorized systems, activity outside the permitted scope or conduct prohibited above. Alvin may seek clarification where an apparent boundary issue arose during otherwise good-faith research.

If you are uncertain whether a proposed activity is permitted, contact security@alvin.finance before proceeding.

7. What you can expect from Alvin

Alvin aims to acknowledge complete vulnerability reports promptly and will prioritize triage according to potential severity and impact.

We may contact you for additional information, clarification or assistance reproducing the issue. We will evaluate the report based on factors including severity, exploitability, affected systems, potential impact and whether the issue is already known.

Where a report identifies a valid vulnerability, Alvin will seek to investigate and address it within a timeframe appropriate to the risk and complexity of the issue. Some vulnerabilities may require coordination with infrastructure providers, suppliers or other third parties and may therefore take longer to resolve.

We may provide progress updates where reasonably practical, but we cannot guarantee a specific remediation date or disclose confidential information about our systems, customers, providers or internal security processes.

Alvin’s vulnerability disclosure process is informed by NIST SP 800-216 (Recommendations for Federal Vulnerability Disclosure Guidelines), including receiving, assessing and coordinating responses to vulnerability reports. Reference to this guidance does not imply NIST review, endorsement or certification.

8. Coordinated disclosure

Please allow Alvin a reasonable opportunity to investigate and remediate a reported vulnerability before making it public.

Alvin generally seeks to coordinate any public disclosure around 90 calendar days after receiving a complete report, but the appropriate timing depends on severity, remediation progress and the safety of affected users. Researchers are asked to discuss proposed publication dates with Alvin in good faith; an earlier or later date may be agreed where appropriate. This does not restrict any disclosure required by applicable law.

Any public disclosure must avoid exposing customer information, credentials, confidential system details or information that could materially increase the risk of exploitation.

Alvin may request that disclosure be delayed where remediation depends on a third party, customers require time to take protective action or immediate disclosure would create a material security, privacy or safety risk.

9. Compensation and recognition

Alvin does not currently operate a paid bug-bounty program. Submitting a vulnerability report does not create an entitlement to payment, reimbursement, employment, compensation or any other reward.

At Alvin’s discretion and with the researcher’s permission, we may acknowledge researchers who submit meaningful vulnerabilities and follow responsible disclosure practices.

We may decline recognition where a report concerns an issue that is already known, cannot be reproduced, has no meaningful security impact, falls outside the scope of this policy or was identified through activity that violated this policy.

10. Issues that may not qualify

The following issues will generally not be treated as reportable vulnerabilities unless they create a demonstrable security impact:

• automated scanner output without evidence of exploitability

• missing security headers without a practical security consequence

• self-cross-site scripting

• user-interface concerns without a security impact

• rate-limiting observations that do not enable meaningful abuse

• outdated or unsupported browser behavior

• vulnerabilities requiring physical access to an already unlocked device

• hypothetical attacks without a credible attack path

• information that was intentionally made public

• issues affecting obsolete or unsupported software

• email-spoofing reports without evidence of inadequate email-authentication controls

We still encourage you to report an issue where you reasonably believe the surrounding circumstances create a meaningful risk.

11. Privacy

Information submitted through this disclosure process will be used to evaluate, investigate, remediate and document the reported issue.

We may share relevant report information with Alvin personnel, contractors, professional advisers, infrastructure providers or other third parties where reasonably necessary to investigate or resolve the vulnerability.

We will handle personal information submitted through this process in accordance with Alvin’s Privacy Policy.

12. No waiver

This policy does not waive any rights or remedies available to Alvin, our customers, users, suppliers or other parties in relation to conduct that falls outside this policy, causes harm, violates applicable law or is not undertaken in good faith.

Alvin may update this policy from time to time. The version in effect when a report is submitted will generally govern that report.

13. Contact

Please report suspected security vulnerabilities to the address below. If delivery fails, contact hello@alvin.finance:

security@alvin.finance

Use the subject line:

Security vulnerability report