Security
Security and vulnerability disclosure
Sealambda builds and operates software that handles sensitive data: health information in a health and wellness CRM, and conversations between our customers and their end users on WhatsApp, Instagram, Facebook and email, processed by AI agents. Security is owned at founder level, not delegated. This page names who is responsible, how we work, and how to report a vulnerability.
Security lead
- Name
- Giorgio Azzinnaro
- Title
- Co-founder
- giorgio.azzinnaro@sealambda.com
- linkedin.com/in/giorgioazzinnaro
How we work
- Written policies
- Our information security, data handling and incident response policies are written down, approved by both managing directors, and reviewed at least once a year.
- Tenant isolation
- Isolation between tenants is enforced at the data layer.
- AI agent safeguards
- Agents are tested adversarially for prompt injection, data leakage, cross-tenant access and tool misuse. Each agent's tool permissions are scoped to its task, conversations can be escalated to a person, and end users are told when they are talking to an AI.
- Hosting and encryption
- Production servers and databases run in the EU, in Germany. Some vendors, including the AI model providers our agents use, are based outside the EU. Every public endpoint uses TLS, and in our messaging platform, message content and attachments are also encrypted at rest.
- Access control
- Access is granted on a least-privilege basis and removed within 24 hours when someone leaves or changes role. Server access uses SSH keys only, and databases and admin dashboards are reachable only over a private network.
- Dependencies
- Open-source dependencies are reviewed before we adopt them.
- Incidents
- We follow a written incident response plan. If an incident affects customer data, we notify the affected customers as quickly as possible, and the authorities and affected people where the nFADP or the GDPR requires it.
Reporting a vulnerability
Email the report to security@sealambda.com. Please include:
- the affected URL or app
- steps to reproduce
- the impact, as you understand it
- how we can contact you
What we commit to
- We acknowledge your report within 3 business days.
- We send you a triage update within 10 business days.
- We keep you informed until the issue is fixed.
- We credit you for the finding, if you want to be credited.
In scope
sealambda.com, and the services and apps Sealambda operates.
Out of scope
- Third-party platforms we integrate with, such as Meta and our cloud providers. Report those to the vendor directly.
- Our customers' own systems.
- Social engineering and physical attacks.
- Denial of service and spam.
- Automated-scanner output, or missing headers, without a demonstrated impact.
Rules
- Test only with accounts you own.
- Do not access other tenants' or users' data beyond the minimum needed to demonstrate the issue.
- Do not disrupt our services.
- Allow 90 days from your report before any public disclosure.
Safe harbour
Good-faith research that follows these rules is authorised. We will not pursue legal action against you for it.
Bug bounty
We do not currently run a paid bug bounty.
Last updated: