Vulnerability disclosure policy

Found a vulnerability in a Fluxive system? Tell us. This document sets out what you may report, how to do it, the timelines we commit to, and the undertakings we give you in return. We take every report seriously and do not assume bad intent.

1. Scope

This policy covers systems that Fluxive itself operates:

• fluxive.be and its subdomains
• the Fluxive Housekeeping platform
• the other online services Fluxive offers in its own name

2. How to report

Send your report to security@fluxive.be, in English, Dutch or French. We reply to you in person the same working day, or the next working day if your report arrives outside office hours or at the weekend.

You may report in two steps: first a short notice (which system, what is wrong in a few sentences), then the full report. A full report gives the system or address concerned, a description, the steps to reproduce the issue, the impact as you see it, and the date and time you found it. Screenshots or a short recording help.

Do not send other people's personal data where it is not needed. If one record makes the point, send one.

If you also want the legal protection described in section 6, report to the Centre for Cybersecurity Belgium (CCB) as well, at vulnerabilityreport@ccb.belgium.be, following the procedure at ccb.belgium.be/cert/vulnerability-reporting-ccb. The law then requires a short notice within 24 hours and a full report within 72 hours of the discovery, each sent to us and to the CCB.

3. What you can expect from us

• We acknowledge every report in person the same working day (see section 2). You get a substantive first response within 5 business days.
• We tell you whether we confirm the vulnerability and, if so, what we are doing about it and when.
• We keep you informed until the vulnerability is resolved.
• Fluxive is a small business. We do not promise 24/7 handling, but we do commit to answering within these timelines.

4. Publication

Do not make the issue public before we have been able to fix it. We ask for up to 90 days from your report. If it is fixed sooner, you may publish as soon as we confirm the fix. If we need more time, we will ask you and explain why. We do not use this window to keep a problem quiet.

If you also reported to the CCB, any publication needs the CCB's consent as well. Our consent does not replace it. If you publish without the CCB's consent, you lose the legal protection described in section 6.

5. What we ask you not to do

• No denial of service, load testing, or automated scanning that degrades the service.
• No social engineering, phishing, or approaches to staff, clients or suppliers.
• No physical access to buildings or equipment.
• Do not go further than needed to demonstrate the vulnerability: do not alter or delete data, do not download third-party data, do not retain access.
• Do not examine client systems (see section 1).

6. Legal position

This is Fluxive's policy, not legal advice. If you are unsure about your own situation, ask a lawyer.

Our permission. If you stay within sections 1 and 5, you have our permission to look for vulnerabilities in the systems listed in section 1 and to report them to us. That matters: Belgian criminal law punishes, among other things, accessing a computer system without being entitled to. Our permission covers finding and demonstrating a vulnerability. It does not cover viewing, copying or keeping other people's data beyond what is needed. We can only give permission for what is ours: not for client systems, not for the platforms of our hosting and software suppliers, and not for other people's communications.

What we undertake. Fluxive will not bring civil proceedings or file a criminal complaint against anyone who reports in good faith and stays within this policy. If we have to notify a data breach to the Data Protection Authority or inform clients, we will. That is not a complaint against you. Decisions on prosecution belong to the public prosecutor and the courts, not to Fluxive.

The statutory procedure. Separately from this policy, Belgian law has a regime for people who report vulnerabilities: articles 22 and 23 of the law of 26 April 2024 (the NIS2 law). It covers small businesses like Fluxive too. Under that law, someone who reports through the CCB and meets every condition commits no offence of hacking, interception of communications or breach of professional secrecy. The conditions include: you act without fraudulent intent or intent to harm; you send a short notice within 24 hours and a full report within 72 hours, to us and to the CCB; you go no further than necessary and proportionate; you publish nothing without the CCB's consent. The full conditions are at ccb.belgium.be/cert/vulnerability-reporting-ccb. Whether they are met is ultimately for the courts to decide.

You may use this policy and the statutory procedure together. If the CCB contacts us about your report, we will cooperate.

Both protect you under Belgian law only. If systems sit wholly or partly outside Belgium, foreign law may also apply.

7. Reward

Fluxive runs no bug bounty programme and pays no reward for reports. We would rather say so up front than afterwards. What we do offer: if you want it, we will credit you by name once the vulnerability is fixed.

8. Contact