Security and disclosure

Personal data is encrypted in transit (TLS) and at rest, with AES-256-GCM encryption for particularly sensitive data such as the phone numbers participants enter for CMD exercises, which are deleted automatically when a session ends. Our platforms use role-based access control, a multi-tenant database architecture with row-level security, automatic deletion processes and audit logging. Platform data is hosted in the UK.

Every third party that processes personal data for us is under a data processing agreement and listed in our sub-processor register. Our Privacy Policy sets out what we collect and how long we keep it. Where we become aware of a breach likely to put your rights and freedoms at risk, we notify you and the ICO within 72 hours.

Our security policies, assurance programme and due diligence pack are available to customers and prospects on request at legal@cyberescaperoom.co.

Email security@cyberescaperoom.co. Please include:

• A clear description of the vulnerability
• The affected system or URL
• Steps to reproduce, as detailed as you can
• Your assessment of the potential impact
• Proof-of-concept code or screenshots, if relevant

Encrypted communication is welcome. If you would like to use PGP, request our public key at the same address.

• Acknowledgement within 48 hours. We will confirm receipt of your report.
• Regular updates. We will keep you informed as we investigate and fix.
• Honest timelines. We will give you a realistic estimate for resolution. Complex issues take longer; we will not string you along.
• Credit, if you want it. We are happy to acknowledge researchers publicly for valid, responsibly disclosed findings. Tell us your preference.

In scope: cyberescaperoom.co and all subdomains, including our platform subdomains, and every product operated by The Cyber Escape Room Co. Ltd.

Out of scope: denial of service attacks, social engineering against our staff, physical attacks on our infrastructure, and vulnerabilities in third-party services we use but do not control.

If you are not sure whether something is in scope, report it anyway. We would rather know.

We ask researchers to:

• Act in good faith and avoid accessing, modifying or deleting data beyond what is needed to demonstrate the vulnerability
• Avoid disrupting or degrading our services
• Not disclose the vulnerability publicly before we have had a reasonable chance to address it; we ask for 90 days from acknowledgement
• Comply with applicable law

In return, we commit to:

• Not pursuing legal action against researchers who act in good faith under this policy
• Not referring reports to law enforcement unless we have reason to believe the activity was malicious
• Treating your report confidentially until disclosure is agreed

security@cyberescaperoom.co for vulnerabilities. legal@cyberescaperoom.co for everything else.