Security

Reporting a security problem

If you have found a security weakness in Ottom, write to [email protected] with the word Security in the subject. A person reads every report. This page says what to send, what we do with it, and what we ask of you while we fix it.

What to send

• The page, route or feature where the problem is.
• The steps that show it, in order, so we can see it for ourselves.
• What someone could do with it, as far as you know.
• How you would like to be named when we thank you, or that you would rather not be.

Please do not send us anybody else’s personal data, even as proof. A screenshot of your own account or test data is enough.

What we promise

• A reply from a person within 5 working days, saying whether we can reproduce it.
• Updates as we work on it, and word from us when it is fixed.
• No legal action against anyone who finds and reports a problem in good faith and within the rules below.

We do not run a paid bug bounty.

What we ask of you

• Use your own account and your own data. Stop as soon as you reach anyone else’s.
• Do not change or delete data, degrade the service, or send large volumes of automated traffic.
• No phishing, social engineering or physical attempts against us or our suppliers.
• Give us 90 days to fix it before you publish anything, or tell us why that is too long and we will talk about it.

Out of scope

• Findings from an automated scanner with no demonstrated impact, such as a header you would like us to add.
• Problems in Stripe, Shopify, Google or other services we use. Report those to them.
• Our agents visiting your store. That is not a security problem, and there is a separate address for it: [email protected]. How it works is on our agent disclosure page.

For tools

The same contact is published in machine-readable form at /.well-known/security.txt, following RFC 9116.

How we protect your data

The controls that protect the data we hold, where it is stored and the services we use are set out in our trust centre.