Security

Reporting a vulnerability

If you believe you have found a security vulnerability in any Verdan property (verdansafety.com, api.verdansafety.com, hq.verdansafety.com, or our mobile and field applications), please email security@verdansafety.com. Include enough detail for us to reproduce the issue: affected URL or component, steps, and any proof-of-concept.

Our machine-readable policy lives at /security.txt (also served at /.well-known/security.txt), and this page is the Policy target it references.

Our commitment

We acknowledge reports within 5 business days and keep reporters informed of remediation progress. We will never pursue legal action against, or throttle the traffic of, anyone who researches our systems in good faith and within the scope below.

Scope

In scope:

• verdansafety.com and all subdomains, including staging and preview surfaces
• The Verdan tenant dashboard, worker portal, and mobile web entry points
• Our public API surface at api.verdansafety.com

Out of scope:

• Denial-of-service, spam, or social engineering of our staff or customers
• Physical security, or testing that degrades service for real construction crews
• Anything requiring a customer's data, or an account you are not authorized to use

Safe harbor

We consider security research conducted in good faith and within this policy to be authorized. We will not initiate legal action or refer reports to law enforcement for researchers who respect the scope above, avoid privacy violations and service degradation, and give us a reasonable window to remediate before public disclosure. We ask that you do not access, modify, or exfiltrate data that is not your own.

How we protect your data

Verdan isolates every general contractor's data in its own tenant boundary, encrypts traffic in transit with TLS, and enforces multi-factor authentication for all internal staff access to production systems. Access to production data is logged and auditable. A public audit trail records compliance-relevant changes such as document reviews and insurance verification.

Disclosure

We publish fixes as they ship and credit reporters in our release notes when they wish. Coordinated disclosure is the default: please allow us up to 90 days to resolve an issue before publishing details.