Security Policy
Last updated: 30 September 2026
Security testing of Keepnet systems is not permitted without prior written authorisation from Keepnet. This policy is not an invitation to scan or test our websites, platform, APIs, add-ins, applications or infrastructure. Keepnet does not run a bug bounty programme.
1. Legal notice
This policy does not grant permission under the Computer Misuse Act 1990, or any equivalent law in another country, to access, attempt to access, scan or interact with Keepnet systems.
This policy does not permit any action that breaches the law, or that could cause Keepnet to breach its legal obligations, including the Computer Misuse Act 1990, the Investigatory Powers Act 2016, the UK GDPR and the Data Protection Act 2018.
2. Scope
This policy applies to keepnetlabs.com, all of its subdomains, and all other domains, applications and infrastructure owned or operated by Keepnet.
3. Security testing requires written authorisation
Security testing of any Keepnet system is permitted only with prior written authorisation signed by Keepnet. This includes:
automated vulnerability scanning
penetration testing
fuzzing
credential testing
denial of service
social engineering of Keepnet employees
To request authorisation, email security@keepnetlabs.com before you start, with:
your name and organisation
the systems you want to test
your planned methods and tools
your testing window
the IP addresses you will test from
Do not start testing until you receive a signed authorisation letter from Keepnet.
Keepnet customers who want to test their own account should contact their Customer Success Manager. Customer testing is carried out under the Keepnet Security Testing Rules of Engagement.
4. Reporting an issue you noticed
If you notice a security issue during normal use of our services, report it to security@keepnetlabs.com with:
the affected URL or component
steps to reproduce
the impact
When reporting, you must not:
access, download, modify or keep data that does not belong to you
run further tests to confirm or expand the issue
share the issue with anyone until we confirm it is resolved
We acknowledge valid reports within 5 business days.
5. No bug bounty
Keepnet does not run a bug bounty programme and does not pay for reports. We do not respond to requests for payment.
A demand for payment in exchange for vulnerability details, or a threat to publish a vulnerability or data, will be referred to law enforcement.
6. Out of scope
We will not act on reports that only list output from automated tools, or findings without demonstrated impact, including:
missing security headers
TLS/SSL configuration
SPF, DKIM or DMARC records
clickjacking on pages without sensitive actions
software version disclosure
self-XSS
rate limiting on non-sensitive endpoints
7. Good faith reports
If you report an issue you noticed during normal use of our services, in line with this policy and without active testing or payment demands, Keepnet will not take legal action against you in respect of that report.
This does not apply to testing carried out without written authorisation.
8. Your rights
This policy does not limit any rights or protections that apply to you under the law of your country. Keepnet reserves all of its legal rights.
9. Contact
Security reports: security@keepnetlabs.com
security.txt: https://keepnetlabs.com/.well-known/security.txt
Company: Keepnet Labs Ltd, company number 11047987, 124 City Road, London, EC1V 2NX, United Kingdom
Last updated