SmartSpend Contact

Security Disclosure Policy

App: SmartSpend
Operator: Firmeza Consulting cc
Effective Date: 05 April 2026
Last Updated: 05 April 2026

1. Purpose

Firmeza Consulting cc is committed to the security of SmartSpend and its users worldwide. This Policy explains how we handle vulnerability reports and how we respond to confirmed security incidents.

2. Scope

This Policy applies to:

Out of scope:
- Third-party service vulnerabilities (exchange-rate APIs, OS platforms) - report to vendors directly; - Theoretical vulnerabilities without a demonstrable proof-of-concept; - Social engineering of personnel; - Physical access attacks against user devices; - Denial-of-service or load testing without prior written authorization.

3. Reporting a Vulnerability

3.1 If you believe you have discovered a security vulnerability in an in-scope component, report it to us before any public disclosure at:

support@smaartspend.com - Subject: [SECURITY DISCLOSURE] <brief description>

3.2 Please include where possible:

3.3 Please do not:

4. Our Commitments to Reporters

When you submit a good-faith report complying with this Policy:

4.1 Acknowledgement: Within 5 business days.

4.2 Initial assessment: Within 20 business days, including an estimated remediation timeline. Complex issues may take longer; we will keep you informed.

4.3 Safe harbor: We will not pursue civil or criminal legal action against researchers who act in good faith under this Policy. This safe harbor does not extend to conduct that accesses real user data beyond what is minimally necessary, introduces malicious code, or constitutes an independent criminal act under applicable law.

4.4 Coordinated disclosure: We request a remediation window before public disclosure (typically up to 90 days for critical issues). We will agree a disclosure date with you.

4.5 Attribution: With your consent, we will acknowledge contributions in our security acknowledgements. We do not operate a formal bug bounty program at this time.

5. Severity and Response Targets

Severity Description Target Remediation
Critical Unauthenticated RCE, mass data exposure, authentication bypass 14 days
High Authenticated RCE, significant data leakage, JWT forgery 30 days
Medium Limited data exposure, CSRF, rate-limit bypass 60 days
Low Minor information disclosure, UX-level security issues 90 days

These are targets. We will communicate promptly if timelines cannot be met.

6. Incident Notification to Users

6.1 If we confirm a security incident affecting personal data, we will assess notification obligations under applicable data protection law, including GDPR Art. 33/34 (72-hour supervisory authority notification; user notification without undue delay where high risk), UK GDPR, LGPD, CCPA, and applicable breach notification statutes in users' jurisdictions.

6.2 Given our server infrastructure is located in Germany (EU), our primary supervisory authority for GDPR breach notification is the Bundesbeauftragter fur den Datenschutz und die Informationsfreiheit (BfDI). We will also notify other relevant authorities as required by applicable law.

6.3 Security commitment disclaimer. Despite implementing reasonable and industry- appropriate security measures, we cannot guarantee the absolute security of any software or networked system. Security measures described in this Policy reflect practices as of the stated date and are subject to continuous improvement. We do not warrant the App is free from all vulnerabilities.

7. Implemented Security Controls

The following controls are currently in place (not an exhaustive list):

8. Contact

Security reports: support@smaartspend.com - subject [SECURITY DISCLOSURE]
General security enquiries: support@smaartspend.com
Postal: 030915, Namibia, Republic of Namibia