Responsible Disclosure Policy

E-Square Financials handles sensitive personal and financial data, and we take its protection seriously. We welcome reports from security researchers and members of the public who identify potential vulnerabilities in our Platform.

This Responsible Disclosure Policy explains how to report a security issue to us, what is in scope, and what you can expect in return. We are grateful to the researchers who help keep our customers safe.

Email your finding to [email protected].

Please include: • A clear description of the issue and its potential impact. • Step-by-step instructions to reproduce it (proof-of-concept, affected URL/endpoint, request samples). • Any screenshots, logs, or supporting material. • How you would like to be credited (optional).

If your report contains sensitive details, you may request a secure channel and we will arrange one. Please do not disclose the issue publicly until we have confirmed it is resolved.

Acknowledgement — We aim to acknowledge your report within 3 business days.

Triage & Validation — We will assess the report and let you know whether it is accepted, needs more information, or is out of scope, typically within 10 business days.

Resolution — We will work to remediate confirmed vulnerabilities promptly, prioritised by severity, and will keep you informed of progress.

Recognition — With your permission, we are happy to credit you publicly once the issue is fixed.

In scope: • esquarefinancials.in and its subdomains • Our customer-facing web application and public APIs • The E-Square Financials mobile application

Out of scope: • Denial-of-service (DoS/DDoS), volumetric, or load-testing attacks • Social engineering, phishing, or physical attacks against our staff or offices • Reports from automated scanners without a demonstrated, exploitable impact • Missing security headers, cookie flags, or best-practice suggestions with no concrete exploit • Vulnerabilities in third-party services we use (please report those to the respective vendor) • Spam, content injection, or self-XSS that cannot affect other users

If you make a good-faith effort to comply with this policy during your research, we will consider your actions authorised, will work with you to understand and resolve the issue quickly, and will not pursue or support legal action against you.

To qualify for safe harbour you must: only test against your own account or accounts you have explicit permission to use; avoid accessing, modifying, or deleting other users' data; not degrade, disrupt, or damage our services; and give us a reasonable opportunity to remediate before any public disclosure.

Please act in good faith and within the law. When researching, you must not: • Access, download, or retain personal or financial data belonging to other users — if you encounter such data, stop and report it immediately. • Perform any action that could harm the availability or integrity of our services or data. • Use a vulnerability beyond the minimum necessary to demonstrate it. • Demand payment in exchange for withholding details of a vulnerability — this will be treated as extortion, not disclosure.

E-Square Financials does not currently operate a paid bug bounty programme. We recognise valid, original, and responsibly disclosed reports through public acknowledgement (a security researchers' hall of thanks) where the reporter wishes to be named.

We review this position periodically. Any future paid programme will be announced on this page.

Security reports: [email protected] General support: [email protected]

Machine-readable policy: https://esquarefinancials.in/.well-known/security.txt