Secure development
We apply reasonable secure development practices, assess the security risks of our products, fix confirmed vulnerabilities in proportion to their impact, protect the integrity of official releases and updates, and keep a channel open for vulnerability reports. How to report one is set out in our Vulnerability Disclosure Policy.
Accurate information
We describe our products, licensing conditions, supported environments, limitations, local processing model and security-relevant behaviour accurately. We do not claim that a feature is anonymous, private, secure, legally compliant or capable of an outcome unless we can back that claim, and we correct material inaccuracies as soon as we learn of them.
Responding to abuse
We do not monitor what users do locally. We do assess credible, specific reports of unlawful abuse involving infrastructure we control, and we take reasonable, proportionate action when the law or a valid order from a competent authority requires it.
That action can include preserving licensing or security records where the law requires it, restricting access to our services, revoking a licence under its terms, fixing a vulnerability or cooperating with a legally binding request. We never use an abuse report as a pretext to inspect unrelated investigations or to collect content we do not ordinarily process.
Reports and requests
Reports about a suspected licence compromise or concrete unlawful use of our infrastructure can be sent to [email protected]. A useful report names the service or licence concerned, describes the conduct precisely, gives dates and reproducible evidence where available, and explains your relationship to the affected system or information. We may ask for clarification, and we avoid collecting investigative or personal data we do not need.
We do not act on informal demands that are unlawful, technically impossible, disproportionate or unsupported. Requests from public authorities are assessed for validity, scope and jurisdiction before we disclose anything or act.
Relationship to other terms
These commitments complement the software licence, our Privacy Policy, our security documentation and any commercial agreement. They do not replace rights or obligations imposed by law: where a contractual term conflicts with a mandatory legal requirement, the requirement prevails. Nothing here excludes liability that cannot lawfully be excluded, and our responsibilities do not make Durandir answerable for unauthorised or unlawful use of the software by others.
Review
We update these commitments when our products, licensing infrastructure, security practices or legal requirements change materially. The date shown beside each page identifies its current version.