Reporting a security problem

Flowtiv holds firms’ client correspondence, contracts and payment details, so we want to hear about any weakness you find. Thank you for reporting it to us privately.

How to report

Email maito:[email protected] with what you found, where, and the steps to see it. We’ll reply within three business days, keep you told as we fix it, and tell you when it’s fixed. Please give us 90 days to fix a problem before you talk about it publicly.

What’s in scope

The Flowtiv app and its API, the client and subcontractor portal, and firms’ websites served by Flowtiv. Firms’ own systems, and third-party services Flowtiv connects to, are out of scope: report those to their owners.

While you look

  • Use only accounts you own or have permission to use.
  • Don’t look at, change or keep anyone else’s data. If you come across some, stop, and tell us what you saw.
  • Don’t disrupt the service: no denial of service, spam, or automated scanning that floods it.
  • No social engineering of Flowtiv’s staff or customers, and no physical attacks.

If you act in good faith within these rules, we won’t take action against you for your research, and we’ll say so to anyone who asks.