Trust Center
Security, privacy, availability, subprocessors, abuse handling, and disclosure-process overview.
Open Trust CenterSecurity contact
Security & Contact
Use this page for responsible disclosure, security review requests, abuse reports, and privacy escalation routes. Broader trust documentation lives in the Trust Center and Security Practices pages.
Responsible disclosure
Send suspected vulnerabilities to [email protected]. Include the affected URL or endpoint, reproduction steps, impact, account context, request identifiers if available, and whether any data exposure occurred.
Good-faith reports are reviewed for security impact. AssetLed does not authorize destructive testing, spam, denial-of-service traffic, credential stuffing, social engineering, physical attacks, malware, persistence, or attempts to access another customer's data.
Testing boundaries
Security testing must use no production-data access and must never attempt to view, change, export, or delete data that belongs to another customer.
- Use only accounts, domains, mailboxes, API keys, and Google properties you own or are explicitly authorized to test.
- Do not use production-data access as proof. Use minimal synthetic records and redact secrets from reports.
- Do not send outbound outreach to real recipients while testing without consent.
- Do not bypass suppression, unsubscribe, mailbox warmup, rate limiting, or tenant isolation controls.
- Stop testing and report immediately if you encounter another customer's data, credentials, reports, or billing records.
Security and trust documents
Security Practices
Implemented authentication, authorization, tenant isolation, data protection, logging, and incident-response controls.
Open Security PracticesSubprocessors
Public provider categories, purposes, data categories, transfer notes, and Mailgun/outreach email separation.
Open SubprocessorsContact routes
- Security
- [email protected] for vulnerabilities, security reviews, and responsible disclosure.
- Privacy
- [email protected] or privacy-request for access, deletion, DPA, or data-processing requests.
- Data deletion
- Use data-deletion for deletion requests from users, former users, prospects, and Google OAuth data subjects.
- Abuse
- [email protected] for spam, impersonation, malicious outreach, policy-abuse reports, trial abuse, payment abuse, account evasion, or blocked-trial questions.
- Operations
- [email protected] for Mailgun product-email delivery issues, webhook health questions, outreach mailbox provider authentication or deliverability issues, and onboarding support.