Skip to content

Legal

Security and vulnerability disclosure

How to report a security vulnerability in noccela.com or Noccela products and services: what to include, our response targets and safe harbour for research.

Last updated 22 October 2026. We welcome reports from security researchers, customers and partners who find a vulnerability in our website, services or products. This page explains how to report one and what you can expect from us.

How to report

E-mail support@noccela.com with the subject "Security". The same contact is published in our security.txt file. Please write in English or Finnish.

Include as much of the following as you can:

  • the affected website address, service, product or device, and the version or firmware if you know it
  • a description of the vulnerability and what an attacker could do with it
  • the steps to reproduce it, or a proof of concept
  • the date and time of your tests, and the IP addresses or accounts you used
  • how we can contact you, and whether you would like to be credited

Please keep personal data in your report to the minimum needed, and do not send data you have obtained from our systems beyond what is needed to show the problem.

Scope

In scope:

  • noccela.com
  • Noccela's online services under noccela.io, including the Location Intelligence Platform, the partner portal and the APIs
  • Noccela base stations, tags and their firmware

Out of scope:

  • denial-of-service attacks, spam and social engineering of our staff, customers or partners
  • physical attacks on offices, customer sites or devices installed at customer sites
  • reports from automated scanners without a demonstrated impact
  • third-party services that we link to or use, such as Microsoft, GitHub or YouTube: please report to them directly

What you can expect from us

  • We acknowledge your report within 5 working days.
  • We investigate, keep you informed of our progress and tell you when the problem has been fixed.
  • We agree with you on when and how the vulnerability is disclosed. We ask for a reasonable time to fix it before it is made public, normally up to 90 days.
  • If you wish, we credit you when the fix is announced.

We do not run a bug bounty programme and do not pay rewards for reports.

Safe harbour

If you act in good faith and follow this policy, we will not take legal action against you or report you to the authorities for your research, and we will consider your research authorised. Good faith means that you:

  • only test against accounts, data and devices that you own or have explicit permission to test
  • never test systems that are in use at a customer site; positioning and alerting systems can be part of how people stay safe at work
  • do not access, change or delete data that is not yours beyond the minimum needed to show the vulnerability, and stop as soon as you reach other people's data
  • do not degrade or interrupt our services
  • report the vulnerability to us promptly and do not disclose it before we have agreed on disclosure
  • do not use the vulnerability for any other purpose

If you are unsure whether something is allowed, ask us first at support@noccela.com. This policy cannot authorise testing of systems that belong to third parties, such as our customers.