Sysplore

Current version.

Read the current version Version history

Security

Effective: 2 November 2026

Last updated: 2 November 2026

Version: 1.1

Report a vulnerability

Email [email protected] with a description of the issue, the affected URL or component, and steps to reproduce. A proof of concept helps. Reports go directly to the person who operates the platform.

What to expect:

  • We acknowledge your report within 3 business days.
  • We send a first assessment within 10 business days and keep you updated until the issue is resolved.
  • We ask for 90 days to fix an issue before you disclose it publicly. If we fix it sooner, we will tell you, and we are happy to agree an earlier date.
  • We do not run a paid bounty program. If you want credit for a valid report, say so and we will name you once the issue is fixed.

Scope

In scope: sysplore.com and its subdomains that we operate, sysplore.cloud, sysploremail.com, the *.sysplore.work workspace domain, and the Sysplore Mail, Sysplore Workspace, and Sysplore Cloud services.

Out of scope:

  • Customer-owned domains, tenants, and data. Test only against accounts you own.
  • Third-party services we use (for example Stripe, Cloudflare, Akamai/Linode, Backblaze). Report those to the vendor.
  • Social engineering or phishing of Sysplore staff or customers, and physical attacks.
  • Denial of service or volumetric testing.
  • Automated scanner output without a working proof of concept.
  • Missing best-practice headers or configuration with no demonstrated impact, self-XSS, and rate limiting on non-sensitive endpoints.

Safe harbor

We will not pursue legal action, and we will not suspend your account, for security research that follows this policy. To the extent this policy conflicts with section 4 of the Acceptable Use Policy or section 18 of the Terms of Service, this policy prevails for good-faith research within its scope.

To stay within this policy: test only against your own accounts, access the minimum data needed to show the issue, stop and report immediately if you reach another customer's data, do not degrade the service, do not keep or share data you accessed, and do not disclose the issue before it is fixed or the 90 days have passed.

This policy cannot authorize testing against third parties. Their systems are governed by their own rules.

How we protect data

Area What we do
Encryption in transit Site and console traffic is served over HTTPS at the Cloudflare edge, and HSTS is sent in production. Mail between servers uses TLS, with DANE, MTA-STS and TLS reporting.
Encryption at rest (mail) Each mail account can turn on encryption with an OpenPGP key or an S/MIME certificate that the account holder registers. The private key stays with the account holder and is never held on our systems. The message body and attachments are encrypted. Headers stay readable so clients can list and sort mail, and search on an encrypted account covers the headers, not the body or attachments.
Spam and phishing Every message is scored at SMTP time by a statistical classifier that learns from spam and ham marks, public blocklists (Spamhaus ZEN, SURBL, DBL, Pyzor), DMARC, SPF, DKIM and ARC results, phishing heuristics and sender reputation. Inconclusive messages can go to an AI classifier. A high score is quarantined or rejected.
Abuse controls Authentication failures, relay and recipient probing, loitering connections, and port or exploit scanning are banned automatically, with a recorded reason and expiry.
Data region You choose the European Union or the United States when you sign up. Your Content and backups are stored and processed in that region.
Edge protection Cloudflare sits in front of the origin with managed WAF, rate limiting and bot rules. The origin accepts traffic only from Cloudflare.
Identity and access Staff sign in through an internal identity provider (Keycloak) over OpenID Connect with named roles. Multi factor authentication is available and can be required.
Payments Card data is handled by Stripe and is not stored on our systems.
Backups Backups are encrypted at rest and stored in the region you choose. Database changes are archived continuously and a full backup runs nightly. The backups bucket is protected with object lock.
Patching and updates Operating system and container image patches are applied through a weekly rebuild, rolled out in stages, and nodes run unattended security upgrades.
Logging and monitoring Cluster and pod telemetry run in a monitoring stack with alerts routed to the operations channel. Administrative actions in the dashboard are written to an audit log.
Incident response We maintain an incident response procedure, and we notify affected customers and any competent authority of a personal data breach where the law requires. See the Privacy Policy.

Related documents