Vulnerability Disclosure Policy
If you find a security weakness in AIQ One, please tell us. This page says what you may test, how, what we promise in return, and where the law leaves a gap we cannot close for you.
In scope
- aiqtechlabs.com and aiqtl.com
- app.aiqtl.com (the web app) and get.aiqtl.com (the download page)
- sync.aiqtechlabs.com (the AIQ One server)
- The AIQ One Android apps published by AIQ Research Labs Private Limited
Out of scope
- Denial of service, load or spam testing.
- Social engineering, phishing or physical access, of our staff or our users.
- Services run by others (Meta / WhatsApp, Cloudflare, Amazon Web Services, Google Play). Report those to them.
Rules
- Use only test accounts. Write to us first and we give you test mobile numbers. Never use, read, change or keep another person's data; if you reach some by accident, stop, tell us, and delete it.
- Do only what is needed to show the problem. No back doors, no data taken out, no harm to the service.
- Give us a fair time to fix it before you tell anyone else; we agree the date with you.
Our promise
- We acknowledge your report within 3 working days.
- We tell you how serious we think it is, and we keep you posted until it is fixed.
- With your permission we thank you by name in our fix log. We do not pay rewards yet.
Safe harbour, and its honest limit
If you follow this policy in good faith and stay in scope, AIQ Research Labs Private Limited gives you its permission for that testing and will not bring civil or criminal action against you for it.
The honest limit: India's IT Act (section 43 civil, section 66 criminal) turns on acting "without permission", and this written permission is your defence. We found no court case that confirms a private company's safe harbour in India, and our permission cannot bind the police, a court or anyone else.
How to report
[email protected], with "Security" in the subject (a separate security address is coming): what you found, where, the steps to see it, and how to reach you. A second channel is CERT-In's vulnerability reporting.
AIQ never claims it cannot be broken. AIQ holds no security certification today (no ISO 27001, no SOC 2, no CERT-In audit). What AIQ can show is: the protections on this page, the tests that prove them, the findings it fixed, and a public way to report what we missed.