Caylo takes the safety of program and member information seriously. If you find a security problem in the Caylo app, the Office or caylo.app, we want to hear about it, and we will work with you to fix it.
How to report
Email hello@caylo.app with the subject “Security report.” Tell us what you found, how to see it, and what could happen. Do not include member information.
What we ask
- Test only against your own accounts or accounts we give you. Never view, change, keep or share anyone else’s information.
- Do not disrupt our service, send spam, test physical security, or try to trick our team or our programs.
- If you reach member information, stop, tell us right away, and do not copy it.
- Give us a reasonable time to fix the problem before you tell anyone else.
What you can expect
- We reply within 3 business days and keep you updated.
- We act on your report in good faith and credit you if you want to be credited.
- We will not take legal action against people who follow this policy in good faith.
Out of scope
Missing best-practice settings with no real risk shown, tests that disrupt service, and problems in other companies’ services we do not control.
Records
We record every report, how we handled it and when we fixed it, and keep that record for six years. A report that shows member information may have been exposed is handled under our incident response plan and the program’s Business Associate Agreement.
Caylo LLC · Phoenix, Arizona · hello@caylo.app