Responsible Security Disclosure

Report a Peppol security incident or vulnerability

Reports are handled on a need-to-know basis. Submitted descriptions and technical evidence are encrypted at rest.

Security contact

security@accountai.be

Critical reports are targeted for acknowledgement within 1 hour. Other reports are acknowledged within 1 business day.

Reportable events

Exposed Peppol PKI certificate, private key, or signing secret
Unauthorized document or account access
Suspected data breach, alteration, or loss
Access Point abuse or availability attack
Vulnerability affecting confidentiality, integrity, or availability

Responsible disclosure

Act in good faith, avoid accessing unrelated data, do not disrupt services, and allow reasonable time for remediation before public disclosure.

Do not submit exploit payloads containing real invoice data or any private key material.

Security report form

Provide the minimum sanitized information needed to assess impact. A security reference ID is issued immediately.

Reporter details Full name * Email address * Organization Telephone

Report details Severity * Approximate occurrence time Peppol Participant ID Message ID

Subject * Description * Sanitized technical details I confirm that this report does not contain passwords, private keys, certificate secrets, complete invoice XML, or unnecessary personal data.