SimpleTime Security

If you believe you've found a security vulnerability in Simple Time, please email security@simpleintelligence.io. You can also fetch our machine-readable contact at /.well-known/security.txt.

Please include enough detail to reproduce the issue: steps, the affected URL, your environment, and any proof-of-concept output. Encrypted reports are welcome, request our PGP key in your first message and we'll respond with it.

• Acknowledgement. Within 2 business days of receipt.
• Initial triage. Within 5 business days, with a severity assessment and an expected remediation window.
• Status updates. At least every 7 days until the issue is closed.
• Customer notification. If the issue affects customer data, workspace owners are notified within 72 hours of confirmation, in line with GDPR Article 33.

In scope:

• time.simpleintelligence.io and its API endpoints under /api/
• Simple Time's authentication flows (Microsoft Entra OIDC, Google OAuth, password)
• Simple Time's OAuth integrations with QuickBooks Online, Xero, Google Workspace, Microsoft Graph, and Slack
• OAuth token storage, refresh, and revocation
• Tenant isolation and access control
• Public marketing and legal pages

Out of scope:

• Findings that require physical access to a user's device or a user's already-authenticated session
• Social-engineering attacks against Simple Intelligence Group employees or customers
• Denial-of-service or volumetric attacks; we operate behind Azure Front Door with WAF, please don't generate load to prove this
• Issues that require the use of outdated browsers or operating systems
• Findings in third-party services we integrate with (report those to the vendor directly)
• Missing security headers without a demonstrated impact (we'll still take the report, but we may not treat it as a vulnerability)
• simpletime.simplicityitinc.com, our legacy v1 product, scheduled for decommissioning

If you make a good-faith effort to comply with this policy during your security research, we will:

• Consider your research authorized under the Computer Fraud and Abuse Act and similar laws
• Work with you to understand and resolve the issue quickly
• Not pursue legal action against you for the research described above

We ask that you do not access, modify, or destroy any data that isn't yours, do not pivot to other systems, and give us a reasonable window to remediate before public disclosure (we suggest 90 days from acknowledgement, longer for complex issues).

Simple Time does not currently run a paid bug bounty. We do publish a recognition page for researchers who report valid issues (opt-in, with your handle and a one-line summary of the issue once the fix ships). To opt in, say so in your initial report.

• Hosted on Microsoft Azure (US Central). All customer data encrypted at rest (AES-256) and in transit (TLS 1.2+ with HSTS).
• OAuth tokens encrypted at the application layer using envelope encryption (per-tenant data key wrapped by an Azure Key Vault master key).
• Multi-factor authentication enforced for SSO sign-ins via the customer's identity provider; available as TOTP for password users.
• Database and Key Vault on private endpoints. No public IP on either. Production access is just-in-time elevated and audited.
• Sub-processors disclosed in the privacy policy. Material changes notified at least 30 days in advance.
• Third-party penetration test cadence: at least annually, plus after any material architectural change.