The EU value-chain ceiling limits what large customers may require from suppliers of up to 1,000 employees. Directive (EU) 2026/470 applies to financial years beginning on or after 1 January 2027.The EU value-chain ceilingSee what applies to you →

Vulnerability disclosure policy

If you believe you have found a security vulnerability in CoreCanopy, we want to hear from you, and we will treat your report seriously and you fairly.

Effective 3 October 2026

How to report

Email security@corecanopy.earth with what you found, where, how to reproduce it, and what an attacker could do with it. Screenshots, requests and responses help. Write in English. Please do not include data belonging to anyone else; if you saw some, say so and describe it rather than sending it.

This address is also published in /.well-known/security.txt.

What we commit to

  • Acknowledge your report within three working days.
  • Give you our initial assessment within ten working days.
  • Keep you informed while we fix it, and tell you when it is fixed.
  • Credit you by name when we describe the fix, if you would like that.
  • Not pursue or support legal action against research that follows this policy.

We are a small company. We do not run a paid bug bounty, and we will say so plainly rather than imply one.

In scope

  • corecanopy.earth
  • app.corecanopy.earth
  • admin.corecanopy.earth
  • api.corecanopy.earth

Out of scope

  • Denial-of-service attacks, load testing, and anything that degrades the service.
  • Social engineering, phishing, or physical attacks against us or our users.
  • The services of our sub-processors (AWS, Sentry, Mixpanel, Razorpay, Google). Report those to them.
  • Spam, or sending large volumes of email through our forms.
  • Findings without a demonstrated security impact, such as missing headers on pages with no sensitive content, or software version banners.

How to test responsibly

  • Use your own account. You can create one for free.
  • Do not access, change or delete data that is not yours. If you reach another customer’s data, stop, do not keep it, and tell us.
  • Do not use automated scanners at a rate that affects other users.
  • Give us reasonable time to fix the problem before you tell anyone else. We aim to fix critical issues within 30 days and will agree a date with you.

Safe harbour

If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not initiate legal action against you, and if a third party does, we will make it known that your actions were authorised by us. This does not authorise you to break the law, and it cannot bind the rights of anyone other than Earth Arogyam Innovate.

Back to Trust