PEER Vulnerability Disclosure Policy

Document Version: 1.0
Release Date: 2026-06-23
Next Review Date: 2027-06-23
Expiry Date: 2027-09-23
Contact: security@peergroup.com

Introduction

PEER Group is committed to keeping our products and services secure.

In the event that a security vulnerability is found by our customers, partners, distributors or security researchers, this policy outlines how to send us vulnerability reports and how we coordinate remediation and disclosure. We encourage you to contact us to report potential security issues in our software by following this policy.

Authorization

If you make a good faith effort to comply with this policy during your security research to identify and report vulnerabilities in PEER’s software, we will consider your research to be authorized. Should legal action be initiated by a third party against you for activities that were conducted in accordance with this policy, we will make this authorization known. If you identify any security vulnerabilities, we will work with you to understand and resolve the issue quickly, and, provided that you have complied with this policy and taken due care to prevent malicious exploitation of any vulnerabilities, PEER Group will not recommend or pursue legal action related to your activities in discovering any security vulnerabilities.

If you will be conducting any security research that may potentially violate the terms of any license agreement that you have with PEER, we request that you contact us at security@peergroup.com before starting your research so that we do not simply assume that you are breaching your license agreement with PEER upon becoming aware of your activities. We will be happy to work with you in your research to minimize any disruption to PEER’s systems.

Scope

In Scope

This policy applies to the following products and services:

• Current, supported versions of PEER Group products and services, including cloud back ends, admin portals and APIs
• Production endpoints under domains owned by PEER Group including *.peergroup.com
• Non production testing domains may be considered with prior written consent

Any service not expressly listed above, such as any connected services, are excluded from scope and are not authorized for testing. Additionally, vulnerabilities found in systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system is in scope or not, contact us at security@peergroup.com before starting your research.

Though we develop and maintain other internet-accessible systems or services, we ask that active research and testing only be conducted on the systems and services covered by the scope of this document. If there is a particular system not in scope that you think merits testing, please contact us to discuss it first. We will reassess the scope of this policy over time.

Out of Scope

The following test methods are not authorized and considered out of scope:

• Network denial of service (DoS or DDoS) tests or other tests that impair access to or damage a system or data
• Physical testing (e.g. office access, open doors, tailgating), social engineering (e.g. phishing, vishing), or any other non-technical vulnerability testing
• Unsafe scans: vulnerability checks that risk systems instability (e.g. active buffer overflow tests)
• Placing malware (virus, worm, Trojan horse, etc.) on any system
• Destructive actions: deleting, modifying or exfiltrating production data
• Compromising any systems using exploits to gain full or partial control
• Copying, modifying or deleting data from the system
• Repeatedly accessing the system or sharing access generally with the public or with unauthorized third parties
• Using any access obtained to attempt to access other systems
• Changing access rights of other users
• Using automated scanning tools
• Using a so-called “brute force” attack to access any systems
• Third-Party Services: testing integrated tools or infrastructure not owned by PEER Group (e.g. AWS, Azure, Zendesk)

Reporting a Vulnerability

Guidelines

While carrying out your activities, it is required that you:

• Notify us as soon as possible after you discover a real or potential security issue.
• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
• Subject to the authorization above, otherwise comply with all applicable laws and regulations.
• Only use exploits to the extent necessary to confirm a vulnerability’s presence. Do not use an exploit to compromise or exfiltrate data, establish persistent command line access, or use the exploit to pivot to other systems.
• Provide us a reasonable amount of time to resolve the issue before you disclose it publicly; the amount of time that is considered reasonable for any given situation will be dependent on the impact severity of the vulnerability, the complexity involved in determining the composition and depth of the vulnerability, and the measures necessary for remediation. We would ask you to coordinate with us regarding any public disclosure and provide us with at least ten (10) business days’ notice prior to any unilateral public disclosure on your part.
• Do not submit a high volume of low-quality reports.

Once you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must stop your test, notify us immediately, and not disclose this data to anyone else. In your notification to us, where available, we would ask that you include as many details as possible about your activities leading to the discovery of the vulnerability, including a functional proof of concept of the vulnerability and CVSS impact, to assist in our investigation.

Do not perform any of the actions outlined in the Out of Scope section above.

Process

Information submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. We will not share your name or contact information without express permission.

If you have identified a vulnerability, please:

• submit your report using this form or via security@peergroup.com. Reports may be submitted anonymously
• include the following to help us triage and prioritize submissions:
  • Affected product and version/build
• Location of the vulnerability and the potential impact of exploitation
  • Detailed description of the steps to reproduce (PoC scripts or screenshots are helpful)
  • Logs, screenshots or network traces
  • Be in English, if possible

By submitting a vulnerability, you acknowledge that you have no expectation of payment and that you expressly waive any future claims for payment against PEER Group related to your submission, including for any proposed or actual solution to the submitted vulnerability.

EU Cyber Resilience Act (CRA) Reporting

For products made available in the EU, when we become aware of:

• an actively exploited vulnerability in our product, or
• a severe incident impacting the product’s security,

we will submit mandatory notifications via the Single Reporting Platform (SRP) within the following timeframes:

• early warning within 24  hours,
• full notification within 72  hours, and
• final report no later than 14 days after a corrective measure is available for actively exploited vulnerabilities; within one month for severe incidents.

Notifications are filed once via SRP and shared with the competent CSIRT/ENISA per CRA.

What you can expect from us

When you choose to share your contact information with us, we commit to coordinating with you as openly and as quickly as possible.

• Acknowledgement: We will aim to acknowledge receipt within 5 business days. High risk issues may be prioritized sooner.
• Communication: To the best of our ability, we will confirm the existence of the vulnerability to you and be as transparent as possible about what steps we are taking during the remediation process, including on issues or challenges that may delay resolution. We will maintain an open dialogue to discuss issues.
• Attribution: With your consent, we will credit you in our advisory and changelogs.

Questions

Questions regarding this policy may be sent to security@peergroup.com. We also invite you to contact us with suggestions for improving this policy.

Document change history

We reserve the right to modify this policy on a periodic basis. Please check back from time to time for the most current version. The policy change history is as set forth below.