At Shufti Pro, we strive to secure individuals' digital identities by verifying them and their documents by undergoing rigid KYC and AML checks. The security and protection of the information we collect whilst onboarding customers is an expertise, handled with immense safety.
Being a GDPR-compliant ID verification service provider, we take the safety and security of our customer’s data seriously with our IDV suite consisting of 17+ services and solutions. Therefore, Shufti Pro has partnered with Bugcrowd, the leading provider of crowdsourced cybersecurity solutions, to launch a bug bounty programme. This partnership aims to pentest Shufti Pro’s platform against cyber threats and deliver highly secure and reliable IDV solutions.
Shufti Pro is investing in the bug bounty programme and creating a test environment to invite ethical hackers and cybersecurity researchers to track down hidden vulnerabilities in exchange for a financial reward. Dedicated to creating digital trust and uplifting security standards, this programme demonstrates the company's commitment to comprehending sophisticated fraud tactics used to manipulate IDV systems.
Responsible Disclosure Philosophy
Shufti Pro believes effective disclosure of security vulnerabilities requires mutual trust, respect, transparency and common good between Shufti Pro and security researchers. Together, our vigilant expertise promotes the security and privacy of Shufti Pro’s customers, products, and services.
Shufti Pro accepts vulnerability reports from all sources, such as independent security researchers, industry partners, vendors, customers and consultants. Shufti Pro defines a security vulnerability as an unintended weakness or exposure that could be used to compromise the integrity, availability or confidentiality of our products and services.
Scope of Programme
If you aren’t sure whether a system is in scope or not, contact us at [email protected]
Our Commitment to Researchers
We maintain trust and confidentiality in our professional exchanges with security researchers
We treat all researchers with respect and recognise your contribution to keep our customers safe and secure
We will work with you to validate and remediate reported vulnerabilities in accordance with our commitment to security and privacy
We investigate and remediate issues in a manner consistent with protecting the safety and security of those potentially affected by a reported vulnerability
What We Ask of Researchers
We request that you communicate about potential vulnerabilities in a responsible manner, providing sufficient time and information for our team to validate and address potential issues
We request that researchers make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing
We request that researchers provide the technical details and background necessary for our team to identify and validate reported issues, using the form below
We request that researchers act for the common good, protecting user privacy and security by refraining from publicly disclosing unverified vulnerabilities until our team has had time to validate and address reported issues
Shufti Pro recommends that security researchers share the details of any suspected vulnerabilities across any asset owned, controlled, or operated by Shufti Pro (or that would reasonably impact the security of Shufti Pro and our users) using the web form below. The Shufti Pro Security team will acknowledge receipt of each vulnerability report, conduct a thorough investigation, and then take appropriate action for resolution.