Security Policy
In this article
Last reviewed: September 2, 2026 · Next review: September 1, 2027
This page is the public version of ServiceProfessional's security policy. Our machine-readable contact file is at https://serviceprofessional.app/.well-known/security.txt.
Reporting a vulnerability
Email support@serviceprofessional.app. Please do not post details publicly before we have had a chance to fix the issue.
We do not currently publish a PGP key. If your report contains material you are not comfortable sending in plain email, say so in a first message with no details and we will arrange a secure channel.
In your report, please include:
A description of the vulnerability and its impact.
Steps to reproduce, ideally with a minimal payload or proof of concept.
Whether you have shared the finding with anyone else, and any disclosure-deadline expectations.
Scope
In scope
serviceprofessional.app,svpro.app, and their subdomains, including the customer portal and the marketing siteThe ServiceProfessional iOS and Android apps
Back-end functions and data-access rules reachable through the above
This help center at
help.serviceprofessional.app
Out of scope
Findings only reproducible through social engineering of staff or customers
Self-XSS, or attacks requiring complete physical access to the victim's device
Missing best-practice response headers on non-production preview environments
Denial of service via volumetric attack against shared infrastructure
Third-party services we integrate with (Supabase, Plain, Bird, Revolution Payments, Google, AWS). Report those to the vendor; tell us too if our integration makes the issue worse.
Safe harbor
We will not pursue legal action or law-enforcement referral against researchers who, in good faith:
test only assets listed as in scope,
avoid privacy violations, data destruction, and service degradation,
stop and report immediately if they encounter customer data, and
give us a reasonable time to fix the issue before public disclosure.
We consider such activity authorized under applicable anti-hacking and anti-circumvention laws. If a third party takes legal action against you for research that followed this policy, we will make it known that your actions were authorized.
Rewards
We do not run a bug bounty program and do not pay for reports. We do credit researchers in our release notes with their consent.
How we respond
Severity | Triage | Mitigation or fix |
|---|---|---|
Critical (remote code execution, data exposure) | Under 24 hours | Under 7 days |
High (authentication bypass, privilege escalation) | Under 2 days | Under 14 days |
Medium (information leak, denial of service) | Under 5 days | Under 30 days |
Low (best-practice deviation) | Under 10 days | Best effort |
We acknowledge your report within the triage window, keep you updated weekly while we work on a fix, and credit your disclosure (with your consent) when the fix ships.
Supported versions
ServiceProfessional is a continuously deployed service. Security fixes go to the current production release. Web fixes reach every user on the next deploy; mobile fixes ship through the Apple App Store and Google Play and can take several days to reach devices after we publish them.
Customer notification
If we confirm an incident that exposed a shop's or a customer's data, we notify the affected shop's administrators promptly after confirmation, targeting no later than 72 hours, with what was affected, what we did, and what they should do. Where law requires notifying individuals or regulators, we do so within the statutory period.
Compliance
ServiceProfessional operates under SOC 2 Type 2 controls, audited annually. Vulnerability reports are tracked as security-finding remediation evidence. This policy is reviewed at least annually.