HCM Suite

Draft — not yet published

This trust centre and its vulnerability-disclosure policy are drafts awaiting review. The security contact shown is a placeholder, and the response times and safe-harbour wording are proposals. Nothing on these pages is a commitment yet.

Why it is still a draft

  • Publication has not been switched on.
  • No monitored security mailbox has been configured yet.

Vulnerability disclosure policy

If you believe you have found a security vulnerability in HCM Suite, we want to hear from you. This policy explains how to report it, what we ask of you while you look, and what you can expect from us.

Reviewed 25 Sep 2026; valid until 21 Aug 2027.

How to report

Placeholder — not monitored yet

Reports will go to security@hi.montr.io once this policy is published. Please do not send reports there yet. It will include:

  • What you found and where — the address or API endpoint.
  • Steps to reproduce it, and any proof of concept.
  • The impact you think it has.
  • How to reach you, if you would like to hear back.

Please do not send us personal data you came across. Describe it instead.

Scope

In scope

  • The HCM Suite web application and API at hi.montr.io and the company addresses under it.
  • Company careers sites under careers.hi.montr.io.
  • This trust centre and our public legal pages.

Out of scope

  • Services run by our sub-processors. Please report those to the vendor directly.
  • Denial-of-service or load testing, and anything that degrades the service for others.
  • Social engineering, phishing, or physical attempts against our staff, customers or premises.
  • Sending messages through the product to people who have not agreed to receive them.
  • Output from automated scanners without a demonstrated impact.

Testing guidelines

  • Use only accounts you own or have explicit permission to test with. Never try to reach another customer’s workspace.
  • Stop as soon as you reach personal data or another account’s information, and report what you found. Access no more than you need to show the problem.
  • Do not change, delete or keep any data, and give up any access you gained once you have reported.
  • Give us reasonable time to fix the issue before telling anyone else.

What you can expect from us

Proposed — not yet confirmed
  • We acknowledge your report within 3 business days.
  • We send you an initial assessment within 10 business days.
  • We keep you updated at least every 30 days until it is resolved.
  • We aim to fix confirmed issues and agree public disclosure with you within 90 days.
  • We credit you publicly once the issue is fixed, if you would like us to.

Safe harbour

Draft wording — pending legal review

If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not take legal action against you for it, and if someone else does, we will make it known that you acted within this policy. This does not extend to testing services we do not control.

Rewards

We do not run a paid bug bounty at present.

For automated tools

A machine-readable security.txt (RFC 9116) will be published at /.well-known/security.txt together with this policy.

Vulnerability disclosure policy · HCM Suite