Security & privacy
This page contains AI-generated content.
Capitality is built by Capkrea GmbH in Germany. This page is the public vulnerability-disclosure policy and the monitored security contact. It is product policy, not legal advice.
Report a vulnerability
Section titled “Report a vulnerability”Write to our security contact. German or English. Include the product surface (the web app, a tenant workspace, or a public site), a version or date, and a proof of concept that does not include customer data.
Please do not access other customers’ data, run volumetric denial-of-service, or demand payment as a condition of disclosure.
The same contact is advertised in security.txt (RFC 9116). The disclosure policy on the product origin is capitality.io/security. Capkrea GmbH’s company policy is capkrea.com/security.html.
In scope. The Capitality web application, the public marketing and documentation sites, and the identity service we operate for sign-in.
Out of scope. Systems you operate (your mail, your devices, integrations you configure); issues that exist only in unmodified third-party software we depend on - report those upstream, and tell us if they affect a shipped surface.
Identity and sessions
Section titled “Identity and sessions”Every request is checked against the member’s current role and workspace, so a removed member or a changed role takes effect at once. From your profile you can sign out every other device at any time.
Hosting
Section titled “Hosting”Production workloads run in the EU. Operational details and subprocessors are published on the marketing legal pages as they mature.
How the platform itself is hardened - every application service under the Kubernetes “Restricted” profile: Platform security.
Other pages
Section titled “Other pages”- Security policy (product origin) - RFC 9116 Policy URL
- Imprint - Capkrea GmbH; German is binding
- Privacy - this product origin
- Terms of service
- Company security - Capkrea GmbH