Terms of business:
Client related policies

• We may gather information by observing how you interact with our commercial website, but never gather information how your interact with products and services.

• Registration: When you, or your organization, sign up to use our sites or services, or you sign up to attend a webinar or get additional information about our products and services, we may receive certain necessary information such as your name, job title and contact information such as email address, phone number and address.
• Account/Report Access: To access some of our products and services you may be required to provide us specific information (such as your login credentials) that allows us to verify your identity before accessing certain data we host. This identity verification information is kept secure on our private servers and is only used to assist you in accessing your account or report; this information is not released outside of the relevant Ethicontrol system unless specifically authorized.
• Hotline/EthicsLine Reporters: No personally identifying information is automatically collected from reporters using Ethicontrol applications. Personally identifying information, such as name and e-mail address, is stored only when a reporter voluntarily gives this information for use by a client company.

• Web forms, such as when you type information into a registration form.
• Web logging, which enables us to collect the standard information your browser sends to every web site you visit such as your IP address.

• should not be made to induce certain acts or inactivity, or would not give rise to preferences or prejudices, or could not be regarded as a bribe;
• must comply with local laws and business etiquette traditions;
• should be donated on behalf of the organization and not on behalf of the individual;
• should not be in the form of cash or other cash equivalent;
• must be acceptable and appropriate in the circumstances;
• should correspond to the generally accepted understanding (not to cause surprise) concerning characteristics of such gifts including value and the reason for the gift;
• should be donated openly, not secretly.

• to transfer, promise to transfer, or offer money, a gift, or to show excessive hospitality with the expectation that this will give an advantage or that such an advantage has already been given;
• to transfer, promise to transfer, or offer money, a gift or to show excessive hospitality towards civil servants, subjects of power, or their representatives for "facilitating" or accelerating routine procedures;
• to accept a payment from third parties, in respect of which it is known in advance or it can be reasonably assumed that such payment implies the receipt of benefits by them;
• to accept a gift from a third party in respect of which it is known in advance or it can be reasonably assumed that the gift was offered with the expectation that the Company will give some advantage to such third party;
• threaten or harass an employee who refuses to engage in bribery, or exposes such bribery, or expresses concern about compliance with this policy;
• participate in any activity that may violate this policy.

• High Content from Post-Consumer Recycled Materials
• Low Embodied Energy (consumed to extract, manufacture, distribute and dispose)
• Recyclable, Compostable and Biodegradable
• Non-toxic
• Energy Efficient
• Durable and/or Repairable
• Produced in a Manner that Demonstrates Environmental, Social, and Ethical Values
• Minimal Packaging (packaging should also abide by the above principles)
• Afterlife Reuse/Regeneration Potential through the Company (carpeting, furniture, etc.)

• Computer and processor 1 gigahertz (GHz) or faster
• Memory 2 GB RAM
• Hard disk 3 GB available disk space
• Display - any screen resolution
• Operating system - for the best experience, use the latest version of any operating system.
• Browser - any

Operating system - any

• Chrome 21+ (recommended)
• Firefox 28+
• Edge 12+
• Safari 7+
• Opera 17+
• Android 6.0+

• Client's database
• Client's files
• Encrypted Passwords
• Private Email Addresses

• Cloud service providers
• Database consultants
• Security auditors
• Financial auditors

• Compromise of a database server that contains private user data with evidence that an attacker may have had access to or copied the data off-site.
• Compromise of an application server account that has access to private user data and evidence that the attacker has downloaded or accessed private data.
• Theft of a device known to contain private user data.
• Web application attack used to download a list of all user emails and encrypted passwords.

• Compromise of an application server that does not contain or have access to private user data.
• Compromise of a team member application account that does not have access to private user data.
• Malware infection on a server or team member computer system that does not contain private user data.
• Compromise of non-sensitive user data such as login IP addresses, login history, project permissions.
• Unintentional disclosure of project names, group names, issue titles, or project or user metadata unless this data can cause damage to the user or their business.
• Discovery of a vulnerability that could have been used to compromise private data, but for which there is no evidence of exploitation.
• Theft of a team member's mobile device that does not contain private user data.
• Theft of a team member's private keys, tokens, or other credentials provided there is no evidence they were used to access private user data.

• A summary of the problem
• A severity rating of 1 — 5 (1 being least severe, 5 being most ie. you can easily hijack, impersonate or access any other account or data)
• A PoC or breakdown of how to replicate the issue
• The operating system name and version as well as the web browsers name and version that you used to replicate the issue

• Alexey Yankovsky, ISACA
• We've been working closely with Alexey and his team at ISACA Kyiv Chapter to identify key weaknesses within our app. They've continuously proven to be experts in identifying weaknesses. They have helped us identify and resolve potential security holes such as account hijacking, access token leaks, XSS and CSRF exploits.