Security and responsible disclosure

AMVARA CONSULTING S.L. operates KM0 Digital. This page states what matters if you use the site, Cloud, or Email.

• Encryption: HTTPS/TLS on km0digital.com, cloud.km0digital.com, and mail.km0digital.com, with Let's Encrypt certificates. Mail uses TLS for IMAP and for sending.
• Mail: spam filtering, DKIM signing, and SPF and DMARC records.
• Browser: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
• Data: in Germany, at Hetzner, inside the EU.
• Copies: we keep service copies so we can restore.

We do not claim SOC 2, HIPAA, or CCPA, and we do not claim a penetration test or a third-party audit, unless we publish that claim.

Privacy: legal page.

AMVARA CONSULTING S.L. is certified to ISO/IEC 27001:2022 by TÜV NORD CERT. KM0 Digital, cloud.km0digital.com, and mail.km0digital.com fall within AMVARA's certificate scope as part of its platform and associated services (cloud and mail).

KM0 Digital does not hold ISO 27001 certification under its own name. We design, deploy, and maintain KM0 under AMVARA's certified information security management system and follow those controls in our operations.

If you need the certificate, statement of applicability, or a security questionnaire, contact hello@km0digital.com.

We welcome good-faith reports of security vulnerabilities affecting km0digital.com, cloud.km0digital.com, mail.km0digital.com, and related AMVARA-operated KM0 mail infrastructure.

Please do:

• Report vulnerabilities promptly to hello@km0digital.com.
• Provide clear reproduction steps and impact assessment.
• Avoid accessing, modifying, deleting, or exfiltrating data that is not yours.
• Stop testing once a vulnerability is confirmed.
• Allow reasonable time for remediation before public disclosure.

Please do not:

• Conduct denial-of-service attacks.
• Use social engineering, phishing, spam, or physical attacks.
• Perform unauthorised data access or exfiltration.
• Run intrusive automated scanning of production without prior written approval.
• Attempt lateral movement, persistence, or public disclosure before we have had time to address the issue.

AMVARA will:

• Acknowledge valid reports.
• Investigate and communicate when appropriate.
• Remediate based on severity and risk.
• Not pursue legal action against researchers who follow this policy in good faith.

Security contact: hello@km0digital.com. Machine-readable policy: /.well-known/security.txt.