Security Policy
Introduction
FirstRing is an AI-powered platform for crisis communication and crisis management.
Our users trust us precisely when it matters most. That is why we take the security of our platform and our users' data seriously.
This security policy describes the measures we take, how we handle vulnerabilities, and how you can report a security issue to us.
2. Operational Policy
This policy applies to:
- The FirstRing application at app.firstring.io and related environments
- All related APIs and backend services
- The firstring.io website
This policy does not apply to:
- Third-party services or websites linked to from FirstRing
- Vulnerabilities in third-party software or upstream systems (report these to the relevant vendor)
3. Security Measures
FirstRing implements the following measures, among others, to protect user data and system integrity:
3.1 Application Security
- HTTPS/TLS encryption for all data in transit
- Content Security Policy (CSP) and modern security headers (including HSTS) to protect against XSS and clickjacking attacks
- Input validation on all API endpoints
- Preventing SQL Injection Using Parameterized Queries (ORM)
3.2 Authentication & Authorization
- Token-based authentication (JWT) with a limited validity period
- Passwords are stored exclusively in encrypted form (using bcrypt hashing)
- Role-Based Access Control (RBAC) with strict separation between organizations (multi-tenancy)
- Protection against brute-force attacks through rate limiting on login and password recovery endpoints
- Logging and Monitoring of Failed Login Attempts
- 2FA Security for Profiles with an Authenticator
3.3 Data Protection
- Processing of personal data in accordance with the GDPR; a data processing agreement is available to customers
- Hosting within the European Union (Microsoft Azure, Western Europe region)
- Access to production data is restricted to authorized individuals
3.4 Infrastructure
- Hosting on Microsoft Azure App Services, with the associated platform security (including DDoS protection and TLS termination)
- Logging and monitoring of application and security events using Azure Application Insights
- Regular updates and patch management for dependencies
- Independent penetration tests conducted by a third party
4. Reporting Security Vulnerabilities (Responsible Disclosure)
We encourage the responsible reporting of security vulnerabilities, in line with the Coordinated Vulnerability Disclosure (CVD) guidelines issued by the National Cyber Security Center (NCSC). If you discover a vulnerability in FirstRing, please report it to us immediately and do not disclose it publicly.
4.1 How to Report
Email: security@firstring.io
If possible, please include the following in your report:
- A description of the vulnerability
- Steps to reproduce the problem
- The components or endpoints involved
- The potential impact (confidentiality, integrity, availability)
- A proof of concept or screenshot (if applicable)
- Your contact information
4.2 Response Deadlines
We strive to:
- Confirm receipt of your report within 2 business days
- Provide an initial assessment within 7 business days
- Develop and roll out a solution within 30 days, depending on the severity
- Coordinate disclosure with you after users have been protected
4.3 Classification
We classify vulnerabilities based on the CVSS standard:
- Critical (9.0–10.0): Immediate mitigation and patching
- High (7.0–8.9): patching within 7 days
- Average (4.0–6.9): patching within 30 days
- Low (0.1–3.9): included in regular releases
4.4 What You Can Expect from Us
- We acknowledge your report and will keep you updated on the progress
- If you'd like, we'll list you as the person who reported the issue once it has been resolved
- We will not take legal action against users who follow the rules listed below
4.5 Rules of the Game
- Do not disclose the vulnerability until we have released a fix
- Do not access systems or data beyond what is necessary to demonstrate the vulnerability
- Do not carry out denial-of-service attacks or destructive tests
- Do not use social engineering tactics against our employees or users
- Please give us a reasonable amount of time to resolve the issue
5. Known Limitations
No system is completely secure. We are transparent about the following limitations:
- Dependencies: We update dependencies regularly, but zero-day vulnerabilities in third-party software can never be ruled out
- Third-Party Services: FirstRing uses third-party services (including AI model providers and Microsoft Azure) that have their own security policies
- Social engineering: No technical measure can prevent all forms of social engineering; we recommend that organizations train their users on this topic
6. Contact
Security reports: security@firstring.io Response time: within 2 business days
For any other questions about security or data protection, please contact us via the contact page at firstring.io.
7. Disclaimer
Although we strive to meet the highest security standards, no system is completely secure. This policy establishes clear communication channels and expectations for addressing security vulnerabilities and does not create any legal obligations beyond those set forth in applicable law.
Last updated: August 28, 2026. This security policy may be updated; any changes will be posted on this page.