Security & Responsible Disclosures
Resnova holds itself to an institutional standard of candour and security. This page sets out our coordinated vulnerability disclosure policy, our personal-data breach procedures, and the standing commitments we make about how our systems behave. Our practices align with ISO/IEC 29147 (vulnerability disclosure), ISO/IEC 30111 (vulnerability handling), and NIST SP 800-61 (incident handling).
Safe harbour
Good-faith research under this policy will not face legal action from Resnova.
Audit-grade AI
Consequential automated decisions are logged, attributable, and subject to human review.
We correct openly
When we get something wrong — in a system or in writing — we say so and fix it.
Coordinated vulnerability disclosure
If you discover a security vulnerability in a Resnova system, report it to [email protected] (PGP key available on request). We follow ISO/IEC 29147 and commit to a coordinated process with the following targets:
| Stage | Commitment |
|---|---|
| Acknowledge | Within 72 hours of receipt. |
| Triage | Initial severity assessment within 5 business days. |
| Remediate | Good-faith resolution prioritised by severity (CVSS). |
| Credit | Public acknowledgement to reporters who wish to be named. |
Researcher safe harbour
We will not pursue legal action against researchers who act in good faith under this policy. To qualify, please:
- Avoid privacy violations, data destruction, and service degradation.
- Use only your own test accounts and stop at proof-of-concept.
- Give us reasonable time to remediate before any public disclosure.
- Do not access, modify, or exfiltrate data that is not yours.
Personal-data breach notification
In the event of a personal-data breach, our incident response follows NIST SP 800-61 and our statutory duties under GDPR Articles 33–34:
| Obligation | Timeline |
|---|---|
| Notify supervisory authority | Without undue delay, within 72 hours of awareness where required. |
| Notify affected individuals | Without undue delay where high risk to rights and freedoms. |
| Record | All breaches documented in an internal register regardless of notifiability. |
AI & automated decision-making
Where our platforms use AI to inform consequential decisions, we maintain a decision ledger — an attributable, timestamped, tamper-evident record of inputs, model version, and outcome — and we provide a defined path for human review (consistent with GDPR Art. 22 on automated decisions).
Data residency & sovereignty
For sovereign engagements, the client owns the source code, infrastructure-as-code, model weights, and encryption keys. Resnova operates as custodian, never owner, and supports source-code escrow and a documented exit plan with no lock-in.
Accuracy, conflicts & corrections
Figures, case studies, and projections published by Resnova are sourced or labelled as estimates. Where we identify a material error in published material, we correct it openly and note the change. We disclose material conflicts of interest in our research.
Security & compliance contact
Security reports: [email protected]. Compliance & disclosures: [email protected].