Report a security vulnerability

Last updated: 19 October 2026

Think you have found a vulnerability in AltiusForms? Please write to us before talking about it publicly. We take every report seriously and will not take legal action against anyone who follows the rules below in good faith.

1. How to report

Write to support@altius-group.ch with:

• the address or component affected, and the application version if you know it;
• steps to reproduce, with a minimal proof of concept;
• the impact you expect;
• how to reach you, and the name to credit in the acknowledgements if you wish.

You may write in English, French, German or Italian. Encryption: if your report contains sensitive data, first ask us for a key or an encrypted channel in a message without details; the public key, when there is one, is listed in security.txt.

2. Scope

• The altiusforms.com website and customer area;
• the hosted instances *.altiusforms.com;
• the AltiusForms mobile apps for iOS and Android;
• the API of the portal and of the instances, and the embedding scripts (SDK) served by the instances.

Out of scope: our providers' services (see Subprocessors) — report to them directly; instances self-hosted by our customers, unless the flaw is in the software itself; automated scanner output without a demonstrated real risk; missing best practices without an exploitable impact.

3. Rules

• Do not access, modify or delete other people's data. Use your own account or test instance (the Free offer is enough). If you come across a third party's data, stop, do not keep it and tell us.
• No denial of service, no load testing, no mass sending of messages or forms.
• No social engineering, phishing or physical access aimed at our team or our customers.
• Do not test our providers.
• Keep the vulnerability confidential until it is fixed, or until 90 days after your report if we have not fixed it, agreeing the publication date with us.

4. What we commit to

• Acknowledge receipt within 3 working days.
• Give you a first assessment within 10 working days.
• Keep you informed of the fix and agree the publication date with you.
• Credit you in the acknowledgements, if you wish.

We do not run a bounty programme: we do not promise a financial reward.

5. Acknowledgements

Thank you to everyone who helps keep AltiusForms safe. No report has been published yet.