Snapshot 32026
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Useful Resources Terms of Service Privacy Policy Privacy Policy Addendum for AI Features Vulnerability Disclosure Policy Your privacy and data security are crucial to us at Akiflow, and we constantly work to identify weaknesses in our technology. The responsible disclosure of security vulnerabilities helps us ensure the security and privacy of our systems, our customers and their data. If you believe you've found a security issue in our product or service, we encourage you to notify us. We welcome working with you to resolve the issue promptly. Disclosure Policy Let us know as soon as possible upon discovering a potential security issue, and we'll make every effort to resolve the problem quickly. Please provide us with a reasonable amount of time to resolve the issue before any disclosure to the public or a third party. Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder. While researching, we'd like to ask you to refrain from: Denial of service Spamming Social engineering (including phishing) staff or contractors Any physical attempts against Akiflow property or data centres Bounty program Currently, Akiflow does not officially ensure any bounty for found bugs, but if you believe you've found a security issue with Akiflow, please tell us so we can address it. Your efforts may be eligible for a monetary reward. You may be eligible for a monetary reward if you are the first person submitting a bug and you comply with all the rules listed in this document. Out-of-scope vulnerabilities Anything that's on any domain different than akiflow.com, app.akiflow.com and api.akiflow.com and the desktop client. Dynamic XSS, unless chained with other exploits. Open redirect issues unless chained with other exploits. Network-level Denial of Service (DoS/DDoS) attacks Spam-related issues Issue affecting third parties (Chargebee, Intercom, postmark, etc.) UI and UX bugs (i.e., copy errors, spelling mistakes) Other non-security related bugs Findings from physical testing (i.e., at offices, following employees, etc.) Feel free to reach out to report the problems mentioned above, but most likely, we will not recognize any monetary reward for it. How you should behave while looking for bugs Delete any test data or accounts you have created as part of the research. (if possible) Don't attack or interact with end-users. Don't engage with stolen user data, including credentials. Don't use social engineering attacks, such as phishing. Reporting If you believe you have found a security vulnerability, please report it by emailing [email protected]. Please include a detailed description and potential impact of the vulnerability with the steps required to reproduce the vulnerability, highlighting the security impact. (POC scripts, screenshots and videos are all helpful). Your submission should include instructions for reproducing the vulnerability (written or video). Reports without clear reproduction steps may be ineligible for a reward. FAQ What do we store on our cloud servers? Your Akiflow account, contact information, and your billing information. Data such as, but not limited to, your tasks, labels and other elements created in Akiflow. Data coming from third-party sources relevant to Akiflow (like calendar events, the subject of the emails you star, or the text of slack messages you save). API keys and authorization tokens to access data on third-party sources. We are doing so to provide you with additional features, such as: multiple device synchronization support recovery in case of data loss from your device That means that data such as, but not limited to, your tasks, events, or saved Slack messages is stored on your local machine and synced with our servers. How do we protect the data we store on our cloud servers? To ensure the highest degree of security relative to the Service provided, we take several measures to protect all data we process. These measures include, but are not limited to: User’s contact information (such as name, email, etc.) and user-generated data (such as tasks, events, etc.) are stored in several different databases, on different servers. Access to the servers, and the databases hosted on such servers, is granted only to individual high-level employees, only to the extent needed to maintain and develop the service, and is subject to rigorous authentication mechanisms. We use techniques such as data pseudonymization, the unique identifiers for each user and their data are stored on different databases on different servers. How is data encrypted both in transit and at rest? We implement strong encryption mechanisms. All communications are encrypted using https protocol (TLS). In transit, we use TLS. Regarding API keys and authorization tokens. At rest, data is encrypted using industry-standard 256-bit AES encryption on our servers. Our infrastructure use GCP, and databases are stored at rest, according to GCP policies. How is access to user data controlled and monitored? Internally we follow a minimum access policy to share data. Authentication is linked to GCP and Google accounts to ensure access to personal data. Do you have SOC II / ISO 27001 / Compliance with FERPA requirements? We currently don’t have these certifications. Do you have a Data Processing Agreement (DPA)? Yes, please send our Support team a message in order to get a DPA signed. Still need help? Ask the team Contents Useful ResourcesVulnerability DisclosureFAQ