Security

Relevé holds financial, governance, and workforce data for arts and cultural organisations. Keeping that data safe is part of the product, not an afterthought. This page explains how to report a security problem to us, what we will do about it, and who is accountable.

If you have found a vulnerability in any Relevé system, we want to hear from you, and we will not pursue you for telling us. Please read Safe harbour below.

Email hello@releve.nl with "Security report" in the subject line. Reports go directly to our founders; there is no ticket queue in between.

Please report privately and give us a reasonable chance to fix the issue before disclosing it publicly. We ask for 90 days, and we will tell you as soon as a fix is live, which is usually much sooner.

A machine-readable version of this contact is published at /.well-known/security.txt, following RFC 9116.

What to include

The more of this you can give us, the faster we can act. Do not hold a report back because you are missing some of it.

• Where the issue is: the URL, endpoint, or part of the platform affected
• What the issue is, and what an attacker could do with it
• Steps to reproduce it, including any request or payload you used
• Screenshots, logs, or a short proof-of-concept, if you have them
• How you would like to be credited, if we publish an acknowledgement

Write in English or Dutch, whichever you prefer.

We are a small team, so we commit to targets we can actually meet rather than ones that sound impressive. Business days are Dutch business days.

If a vulnerability led to a personal data breach, our notification duties under Articles 33 and 34 GDPR apply on top of this. Those are described in our privacy policy.

These systems are in scope:

• www.releve.life — this marketing website
• hub.relevee.nl — the Relevé platform
• The backend APIs and edge functions those two depend on
• Our handling of customer data within those systems

These are out of scope. Please report issues in them to the party that runs them:

• Third-party services we rely on, including our hosting, database, analytics, error monitoring, AI processing, and messaging providers. Report the issue to that provider; tell us as well if it affects Relevé data
• Our customers' own websites, systems, and accounts
• Social media accounts and other platforms we do not operate

Findings we are unlikely to act on

We will still read these, but on their own they normally do not qualify as a vulnerability:

• Missing security headers, cookie flags, or TLS configuration with no demonstrated impact
• Output from automated scanners without a working proof-of-concept
• Email configuration findings (SPF, DKIM, DMARC) with no demonstrated spoofing path
• Rate limiting or brute-force concerns without a demonstrated exploit
• Self-XSS, clickjacking on pages with no sensitive action, and missing CSRF protection on forms with no state change
• Vulnerabilities requiring a rooted or compromised device, physical access, or a heavily outdated browser
• Reports that only restate a version number or a public CVE without showing it is exploitable here

Research within these rules is authorised, and we will treat it as good faith:

• Use only your own accounts and test data. Do not access, modify, or download data belonging to another organisation or person
• If you do encounter someone else's personal data, stop, do not keep a copy, and tell us what you saw so we can assess the exposure
• Do not degrade the service: no denial-of-service, no load or stress testing, no high-volume automated scanning
• Do not use social engineering, phishing, or physical intrusion against our team, our customers, or our suppliers
• Do not install backdoors, persist access, or pivot further into our infrastructure than is needed to show the issue
• Keep the details confidential until we have agreed on disclosure

We do not run a paid bug bounty and we cannot offer monetary rewards. We say so up front so that nobody spends time on the expectation of a payout.

What we do offer is a straight answer, a fix, and public credit. With your permission we will name you and link to a site of your choice when we announce the fix. Tell us if you would rather stay anonymous.

Security at Relevé is owned by our CTO and Co-Founder. The role covers our security architecture, access control, supplier review, vulnerability handling, and breach response, and it reports to the board alongside our CEO and Co-Founder. There is no separate security team: in a company this size, accountability sits with the founders rather than with a department.

Both founders are introduced on our about page. Reports sent to hello@releve.nl reach them directly.

Our technical and organisational measures include encryption in transit and at rest, role-based access controls, two-factor authentication on platform accounts, audit logging of who changed what, and error monitoring. We review these practices regularly and as the platform changes.

The detail, including retention periods, international transfers, and our breach notification duties, is set out in our privacy policy and in section 14 of our terms of service. Customer organisations can request our current subprocessor list, naming each provider and where it processes data, by emailing hello@releve.nl.

We may update this policy as the platform and our security practices evolve. The "last updated" date at the top of this page reflects the most recent change. The commitments above apply to reports made while they are published.