Vulnerability Disclosure Policy

Reign AI Solutions
Last reviewed: October 17, 2026

Reporting a vulnerability

If you believe you have found a security vulnerability in this website, please email info@reignai.ca with "Security report" in the subject. Tell us the page address, the steps to reproduce the problem, and what an attacker could do with it. Please do not include anyone else's personal information, and do not open, accept or change a proposal that is not yours.

Scope

In scope: proposals.reignai.ca.

Out of scope:

• Denial of service, load or volume testing, and spam
• Social engineering, phishing, or physical attacks against our staff or offices
• Services run by third parties, including our e-signature and payment providers
• Reports from automated scanners without a demonstrated, exploitable impact
• Missing best-practice headers or settings with no demonstrated security impact

Good-faith research

We will not pursue or support legal action against anyone who, in good faith, researches and reports a vulnerability in line with this policy. That means you: stop as soon as you have confirmed a problem; do not access, change, or delete data that is not yours; do not disrupt the site or its users; and give us a reasonable time to fix the problem (90 days unless we agree otherwise) before you disclose it publicly.

What to expect from us

• We will acknowledge your report within 2 business days.
• We will keep you informed while we investigate and fix it.
• With your permission, we will credit you once the problem is fixed.

We do not run a paid bug bounty program.

Machine-readable contact details are published at /.well-known/security.txt.