Responsible disclosure
Found something? Tell us.A reply within one business day
01You report
What you found and how to reproduce it.
02We confirm we received it
A person replies within one business day.
03We keep you updated
While we fix it.
How do I report a security issue?
Use the form or email us; both reach the same inbox. Test only against your own workspace, never against other customers' data.
What happens after I report a vulnerability?
We will confirm we received it, keep you updated while we fix it, and we will not come after anyone who reports in good faith.
Is there a bug bounty?
No. We run no bounty program and pay no rewards. We say so here so you know before you start.
What have you not finished yet?
Formal SOC 2 work is in progress, not done, and some security controls are still being finished before general availability. We hold no SOC 2 or ISO 27001 report today. Ask us and we will walk your security team through the detail under NDA.
The form
The contact form, topic set to security.
hello@marshalcloud.com, “Security report” in the subject.
Reviewing MarshalCloud instead?
The trust page says what the read role can see, how a fix is approved, and how access ends.