Shufti Pro's Responsible  Disclosure Policy

Submit Report

Introduction 

At Shufti Pro, we strive to secure individuals' digital identities by verifying them and their documents by undergoing rigid KYC and AML checks. The security and protection of the information we collect whilst onboarding customers is an expertise, handled with immense safety.

Being a GDPR-compliant ID verification service provider, we take the safety and security of our customer’s data seriously with our IDV suite consisting of 17+ services and solutions. Therefore,  Shufti Pro has partnered with Bugcrowd, the leading provider of crowdsourced cybersecurity solutions, to launch a bug bounty program. This partnership aims to pentest Shufti Pro’s platform against cyber threats and deliver highly secure and reliable IDV solutions.

Shufti Pro is investing in the bug bounty program and creating a test environment to invite ethical hackers and cybersecurity researchers to track down hidden vulnerabilities in exchange for a financial reward. Dedicated to creating digital trust and uplifting security standards, this program demonstrates the company's commitment to comprehending sophisticated fraud tactics used to manipulate IDV systems.

Responsible Disclosure Philosophy 

Shufti Pro believes effective disclosure of security vulnerabilities requires mutual trust, respect, transparency and common good between Shufti Pro and security researchers. Together, our vigilant expertise promotes the security and privacy of Shufti Pro’s customers, products, and services.

Security Researchers 

Shufti Pro accepts vulnerability reports from all sources, such as independent security researchers, industry partners, vendors, customers and consultants. Shufti Pro defines a security vulnerability as an unintended weakness or exposure that could be used to compromise the integrity, availability or confidentiality of our products and services.

Scope of Program 

–    *.shuftipro.com

–    Mobile SDK's

If you aren’t sure whether a system is in scope or not, contact us at [email protected]

Our Commitment to Researchers 

Trust:

We maintain trust and confidentiality in our professional exchanges with security researchers

Respect:

We treat all researchers with respect and recognise your contribution to keep our customers safe and secure

Transparency:

We will work with you to validate and remediate reported vulnerabilities in accordance with our commitment to security and privacy

Common Good:

We investigate and remediate issues in a manner consistent with protecting the safety and security of those potentially affected by a reported vulnerability

What We Ask of Researchers

Trust:

We request that you communicate about potential vulnerabilities in a responsible manner, providing sufficient time and information for our team to validate and address potential issues

Respect:

We request that researchers make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing

Transparency:

We request that researchers provide the technical details and background necessary for our team to identify and validate reported issues, using the form below

Common Good:

We request that researchers act for the common good, protecting user privacy and security by refraining from publicly disclosing unverified vulnerabilities until our team has had time to validate and address reported issues

Vulnerability Reporting 

Shufti Pro recommends that security researchers share the details of any suspected vulnerabilities across any asset owned, controlled, or operated by Shufti Pro (or that would reasonably impact the security of Shufti Pro and our users) using the web form below. The Shufti Pro Security team will acknowledge receipt of each vulnerability report, conduct a thorough investigation, and then take appropriate action for resolution.

Ready To Get Started?

Drop an email to us at [email protected]