Responsible Disclosure Policy

COPIC Security & Responsible Disclosure Policy

Effective Date: July 1, 2026

1. Purpose

The purpose of this Security & Responsible Disclosure Policy ("Policy") is to explain COPIC's commitment to protecting the security, confidentiality, integrity, and availability of the COPIC Platform and the information entrusted to it.

This Policy also establishes guidelines for the responsible reporting of security vulnerabilities and outlines how COPIC responds to security incidents.

This Policy should be read together with the COPIC:

Terms and Conditions;

Privacy Policy;

Cookie Policy;

Acceptable Use Policy;

Community Guidelines;

Identity Verification Policy; and

Data Retention & Deletion Policy.

By using the COPIC Platform or reporting a security concern, users acknowledge that they have read and agreed to this Policy.

2. Scope

This Policy applies to:

the COPIC website;

mobile applications;

APIs made available by COPIC;

user accounts;

Platform infrastructure;

databases;

cloud-hosted services;

administrative systems;

customer support systems; and

other systems owned or operated by COPIC.

It also applies to security researchers, users, contractors, employees, and third parties interacting with the Platform.

3. Security Principles

COPIC is committed to protecting its Platform by following the principles of:

Confidentiality – protecting information from unauthorized access.

Integrity – protecting information from unauthorized modification.

Availability – ensuring Platform services remain reasonably accessible.

Accountability – maintaining appropriate records of significant security events.

Continuous Improvement – regularly improving security practices as the Platform evolves.

4. Security Measures

COPIC implements reasonable administrative, technical, and organizational safeguards designed to protect the Platform.

These safeguards may include:

encrypted communications using HTTPS/TLS;

secure password storage using industry-recognized hashing algorithms;

role-based access controls;

authentication and authorization controls;

account verification procedures;

security logging;

monitoring for suspicious activity;

secure cloud infrastructure;

routine software updates;

vulnerability management;

backup and recovery procedures;

fraud detection measures.

Security measures may change over time as technology and risks evolve.

5. User Security Responsibilities

Users also play an important role in protecting the Platform.

Users should:

create strong passwords;

keep passwords confidential;

enable available security features where offered;

protect their devices from malware;

keep browsers and operating systems updated;

log out of shared devices;

report suspicious activity promptly.

Users must not:

share accounts;

attempt unauthorized access;

bypass security controls;

exploit Platform vulnerabilities;

interfere with Platform operations;

install malicious software through the Platform.

Failure to follow reasonable security practices may increase security risks.

6. Responsible Disclosure

COPIC welcomes responsible reports of genuine security vulnerabilities.

Security researchers and users who discover a vulnerability are encouraged to report it privately to COPIC before publicly disclosing it.

Responsible disclosure helps protect all Platform users while allowing vulnerabilities to be investigated and addressed appropriately.

7. Reporting Security Vulnerabilities

Security reports should include as much relevant information as possible, including:

description of the vulnerability;

affected feature or page;

steps to reproduce the issue where safe to do so;

screenshots where appropriate;

proof-of-concept information where appropriate;

browser or device information if relevant;

contact information for follow-up.

Providing clear and accurate information helps COPIC investigate reports more efficiently.

8. Good Faith Research

COPIC supports legitimate security research conducted in good faith.

Researchers acting responsibly should:

avoid harming users;

avoid disrupting Platform operations;

avoid accessing information beyond what is reasonably necessary to demonstrate a vulnerability;

report vulnerabilities privately;

stop testing once sufficient evidence has been gathered.

Responsible research contributes to improving Platform security.

9. Prohibited Security Activities

The following activities are prohibited unless expressly authorized in writing by COPIC:

unauthorized access to accounts;

accessing another user's personal information;

password guessing;

credential stuffing;

brute-force attacks;

denial-of-service attacks;

distributed denial-of-service attacks;

malware distribution;

ransomware;

phishing;

social engineering targeting COPIC personnel;

data scraping beyond authorized use;

reverse engineering intended to compromise security;

exploiting vulnerabilities for personal benefit;

introducing malicious code;

bypassing authentication systems.

Violation of these rules may result in account termination and legal action where appropriate.

10. Security Investigations

Where a security concern is reported or detected, COPIC may:

investigate affected systems;

review security logs;

temporarily restrict accounts;

preserve evidence;

request additional information;

suspend affected services where necessary to protect users;

implement emergency security measures.

Investigations are conducted using reasonable judgment based on available information.

11. Security Incident Response

If COPIC becomes aware of a security incident, reasonable steps may include:

identifying the affected systems;

containing the incident;

assessing the impact;

preserving evidence;

restoring affected services;

implementing corrective measures;

reviewing security controls to reduce the likelihood of recurrence.

Where required by applicable law, affected users or authorities may be notified.

12. Vulnerability Management

COPIC regularly reviews Platform security and may:

assess newly discovered vulnerabilities;

prioritize remediation based on risk;

deploy security updates;

improve monitoring systems;

enhance authentication controls;

strengthen fraud prevention measures.

There is no guarantee that every vulnerability can be identified before it becomes known.

13. Third-Party Services

COPIC may rely on trusted third-party providers for services such as:

cloud hosting;

email delivery;

analytics;

security monitoring;

payment-related infrastructure where applicable;

content delivery.

Although COPIC selects providers carefully, each third-party provider remains responsible for the security of its own systems and services.

14. User Data Protection

COPIC uses reasonable safeguards to protect personal information from unauthorized access, alteration, disclosure, or destruction.

Examples include:

controlled administrative access;

authentication procedures;

encrypted communications;

secure storage practices;

security monitoring;

periodic security improvements.

Additional information regarding personal information is available in the COPIC Privacy Policy.

15. Security Logs

COPIC may maintain security-related logs for purposes including:

detecting unauthorized access;

investigating incidents;

fraud prevention;

compliance with legal obligations;

improving Platform security.

Security logs are retained only as long as reasonably necessary or as required by law.

16. Disclosure of Security Information

COPIC generally does not publicly disclose detailed information regarding security vulnerabilities before appropriate remediation has been completed.

This helps reduce unnecessary security risks to Platform users.

Nothing in this Policy prevents COPIC from complying with lawful disclosure obligations.

17. No Reward Program

Unless COPIC officially announces a vulnerability disclosure or bug bounty program, users and researchers should not expect financial compensation for reported vulnerabilities.

COPIC appreciates responsible disclosures regardless of whether compensation is offered.

18. Enforcement

Users who intentionally compromise Platform security may be subject to one or more of the following actions:

warnings;

removal of content;

temporary account suspension;

permanent account termination;

restriction of Platform access;

preservation of evidence;

referral to law enforcement or regulatory authorities where required or permitted by law.

The severity of enforcement depends on the nature and seriousness of the conduct.

19. Limitation of Liability

While COPIC takes reasonable measures to protect its Platform, no computer system can be guaranteed to be completely secure.

Accordingly:

COPIC does not guarantee uninterrupted availability of the Platform;

COPIC does not guarantee that every vulnerability will be discovered before exploitation;

COPIC does not guarantee absolute protection against cyberattacks.

To the fullest extent permitted by applicable law, COPIC shall not be liable for indirect, incidental, special, or consequential damages arising from security incidents beyond its reasonable control.

Nothing in this Policy excludes liability that cannot legally be excluded.

20. Policy Updates

COPIC may update this Policy from time to time to reflect changes in technology, legal requirements, Platform features, or security practices.

Material changes may be communicated through:

Platform notifications;

email;

account announcements; or

other reasonable communication methods.

Continued use of the Platform after changes become effective constitutes acceptance of the updated Policy.

21. Governing Law

This Policy shall be governed by and interpreted in accordance with the laws of the Republic of Kenya.

Nothing in this Policy limits any rights or obligations arising under applicable cybersecurity, data protection, or other relevant laws.

22. Contact Information

Security concerns, suspected vulnerabilities, or responsible disclosure reports may be submitted through COPIC's official support channels or to the official security email address once established.

Reports should include sufficient information to enable investigation.

COPIC will make reasonable efforts to acknowledge legitimate security reports within a reasonable timeframe and to communicate appropriately with the reporting party where further information is required.

User Acknowledgement

By creating an account, accessing the COPIC Platform, or submitting a security report, users acknowledge that they have read, understood, and agreed to comply with this Security & Responsible Disclosure Policy.

Users further acknowledge that responsible security practices by both COPIC and its community contribute to maintaining a safer and more trustworthy Platform for everyone.