Security matters at every layer.

Report a vulnerability

Send security concerns to [email protected]. Include the affected page or application, a concise description of the concern, reasonable reproduction details and a safe way to contact you. Please do not send credentials or unrelated personal information.

Responsible behavior

Avoid disruption, destructive testing, mass scanning, social engineering, data exfiltration or accessing anyone else's private data. Stop testing if you encounter sensitive information. Reporting does not grant authorization to test restricted systems.

What to expect

We review credible reports and follow up where appropriate. Acknowledgment and resolution time depend on severity, verifiability and available information. We do not publish guaranteed response or remediation service levels on this website.

Customer security

Our cybersecurity practice emphasizes practical risk reduction, identity controls, secure configurations and recovery planning. Visit cybersecurity services for details.

1. Security approach

Kurtz Global IT Solutions Inc. approaches technology risk through practical planning, appropriate access controls, service configuration, and incident readiness. Specific contractual security obligations and controls for a customer's managed environment must be documented in the applicable agreement. This page is a public overview, not a statement of independent audit, formal certification, or guaranteed immunity from cyber threats.

2. Report a vulnerability or suspected incident

Send a report to [email protected] with the relevant URL or product, a concise description, affected components, limited steps to reproduce the concern safely, and a contact method. If relevant, tell us whether sensitive information may have been exposed, but do not attach unrelated customer data, credentials, or account secrets.

3. Responsible disclosure expectations

• Do not access, copy, alter, or retain data belonging to other users or customers.
• Do not carry out denial-of-service activity, social engineering, credential guessing, phishing, or disruptive scanning.
• Stop activity immediately if you encounter non-public personal information or customer systems.
• Allow time for investigation and remediation before any public disclosure, and seek authorization before testing systems beyond the public website.

4. Triage and communications

Security reports are assessed based on the information provided, potential impact, exploitability, and systems in scope. We may request clarification or coordinate with an affected platform provider. We do not publish an unverified response-time SLA or bug bounty payment promise.

5. Customer environments and incident responsibilities

When acting as a managed provider or service contractor, incident detection, containment assistance, notification responsibilities, and service availability depend on the agreed statement of work and applicable law. Customers should use the support contacts and escalation steps described in their contract for service incidents.

6. Good-faith reporting and legal boundaries

This reporting channel does not independently authorize penetration testing or waive applicable legal restrictions. Do not assume a safe-harbor commitment unless one is expressly documented. For related matters see Acceptable Use and Privacy Policy.

7. Contacts

Security reporting: [email protected]. General customer support: [email protected]. Privacy concerns: [email protected].