# Security & privacy

This page contains AI-generated content.

> How to report a security issue in Capitality, what is in scope, where production data is hosted, and how every request is checked against your current role.

Capitality is built by Capkrea GmbH in Germany. This page is the public
vulnerability-disclosure policy and the monitored security contact. It is
product policy, not legal advice.

## Report a vulnerability

Write to **[our security contact](https://capitality.io/security)**. German or
English. Include the product surface (the web app, a tenant workspace, or a
public site), a version or date, and a proof of concept that does not include
customer data.

Please do not access other customers' data, run volumetric denial-of-service,
or demand payment as a condition of disclosure.

The same contact is advertised in
[security.txt](https://capitality.io/.well-known/security.txt) (RFC 9116). The
disclosure policy on the product origin is
[capitality.io/security](https://capitality.io/security). Capkrea GmbH's company
policy is [capkrea.com/security.html](https://capkrea.com/security.html).

## Scope

**In scope.** The Capitality web application, the public marketing and
documentation sites, and the identity service we operate for sign-in.

**Out of scope.** Systems you operate (your mail, your devices, integrations you
configure); issues that exist only in unmodified third-party software we depend
on - report those upstream, and tell us if they affect a shipped surface.

## Identity and sessions

Every request is checked against the member's current role and workspace, so a
removed member or a changed role takes effect at once. From your profile you can
sign out every other device at any time.

## Hosting

Production workloads run in the EU. Operational details and subprocessors are
published on the marketing legal pages as they mature.

How the platform itself is hardened - every application service under the
Kubernetes "Restricted" profile: [Platform security](https://docs.capitality.io/platform-security/).

## Other pages

- [Security policy (product origin)](https://capitality.io/security) - RFC 9116 Policy URL
- [Imprint](https://capitality.io/imprint) - Capkrea GmbH; German is binding
- [Privacy](https://capitality.io/privacy) - this product origin
- [Terms of service](https://capitality.io/terms)
- [Company security](https://capkrea.com/security.html) - Capkrea GmbH

---

HTML version: https://docs.capitality.io/security/ · Language: en