VAPTCoordinated vulnerability disclosure platformResearcher recognition, vendor coordination, and CVE support
LoginRequest CVE
Privacy and data handling

Privacy policy.

This policy explains how VAPT processes personal data in connection with vapt.com and its vulnerability reporting workflows.

1. Controller and scope

VAPT is the DBA and operating name used on vapt.com affairs. The VAPT DBA is held by the EU office, WebSec B.V., under EUIPO filing number 019283932. Operationally, WebSec FZCO is the primary office, WebSec B.V. is the EU office, and WebSec Technologies LLC is the US office. Together these entities administer personal data processing for public browsing, contact activity, and vulnerability submissions.

This policy applies to personal data processed in relation to the VAPT website, advisory pages, reporting forms, and related communications concerning vulnerability disclosure and CVE handling.

2. Categories of personal data

Depending on how you interact with the website, VAPT may process the following categories of personal data:

  • Identity and contact details such as your name, email address, organization, and correspondence details.
  • Vulnerability report content, including product details, evidence summaries, references, and any information you choose to submit through the Request CVE workflow.
  • Operational and technical metadata such as timestamps, request logs, IP addresses, and platform-generated identifiers used for security, integrity, and service administration.
  • Publication-related metadata, including attribution or credit information, where you provide it and publication is appropriate.

3. Purposes and legal bases

Personal data is processed only for legitimate operational, technical, legal, and security purposes connected to this website and its disclosure workflows.

  • To receive, review, triage, and coordinate vulnerability disclosures and CVE-related requests.
  • To maintain advisory records, audit trails, and related security or operational documentation.
  • To communicate with reporters, suppliers, and other necessary coordination parties regarding a vulnerability or public record.
  • To secure the website, prevent abuse, investigate incidents, and preserve service availability and integrity.
1
Legal basis

Performance of pre-contractual or requested steps where you ask us to review or handle a submission.

2
Legal basis

Legitimate interests in operating a secure disclosure platform, maintaining records, protecting infrastructure, and publishing accurate advisories.

3
Legal basis

Compliance with legal obligations where retention, disclosure, or record-keeping is required by law or lawful process.

4
Legal basis

Consent where consent is the appropriate basis for a specific activity.

4. Disclosure-related sharing

Because VAPT operates a vulnerability disclosure and publication workflow, relevant data may need to be shared with limited third parties where necessary to assess, coordinate, or publish a matter properly.

  • Hosting, infrastructure, database, email, and security service providers acting on behalf of VAPT and its operating entities.
  • Affected suppliers, maintainers, or other responsible parties where disclosure coordination reasonably requires communication of relevant report information.
  • Appropriate CNA, Root, legal, insurance, or regulatory counterparties where required for CVE handling, compliance, dispute resolution, or lawful requests.
  • The public, but only to the extent information is intentionally included in a published advisory, CVE record, or public credit statement.

5. Retention, security, and rights

VAPT retains data only for as long as reasonably necessary for disclosure handling, security operations, legal compliance, record integrity, and historical advisory maintenance. Different categories of data may be kept for different periods depending on their purpose.

Appropriate technical and organizational measures are used to protect confidentiality, integrity, and availability. No method of transmission or storage is entirely risk-free, but reasonable safeguards are applied in light of the nature of the platform.

  • Request access to your personal data and information about how it is processed.
  • Request rectification of inaccurate or incomplete personal data.
  • Request erasure, restriction, or objection where the conditions under applicable law are met.
  • Lodge a complaint with your competent supervisory authority, including the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) where applicable.