Report a security flaw

Last updated: October 18, 2026

Indivia holds people's financial records, so we take security flaws seriously. If you think you found one in the Indivia app, the server or these web pages, please tell us first, privately, so we can fix it before anyone misuses it.

How to report it

Write to security@indivia.app. Please include:

• what the flaw is and where it is (the address, the screen or the version of the app);
• the steps to see it again;
• what someone could do with it;
• how to reach you, if not by replying to your email.

English or French, as you prefer. Don't send anyone's personal information: if you came across some, tell us, don't copy it.

What we promise

• We reply within 5 business days to say we received your report, then keep you informed until it is fixed.
• We will not take legal action against you, or ask anyone else to, for research done in good faith that follows the rules below.
• We will tell you when the flaw is fixed and, if you wish, thank you by name.

We are a small company and do not pay rewards (a "bug bounty") for now.

Rules for research in good faith

• Only use your own account, or test accounts you made. Never look at, change or delete other people's data.
• Stop as soon as you reach information that isn't yours, and tell us.
• Don't slow down or stop the service: no denial of service, no automated scanning that sends lots of requests, no spam.
• No social engineering of our staff or users, and no physical tests.
• Give us a reasonable time to fix the flaw before telling anyone else about it (90 days unless we agree otherwise).

Out of scope

Reports that only say a header or a setting is missing, without a way to use it, and flaws in other companies' services (Google sign-in, the email provider) should go to those companies.

This page is also published, for tools that look for it, at /.well-known/security.txt.