Security reporting

1. Current website scope

The current Helmwize website is an informational preview with illustrative interactions. The application has no customer account service, file-upload processing, live operational integration or AI inference backend. Public hosting, email and any later services have separate infrastructure and must be assessed in their actual deployment.

This notice is not a statement that the website or a future platform is certified, penetration-tested, immune to attack or suitable for safety-critical operation. We do not claim ISO certification, SOC assurance, class approval or a government trustmark without publishing the relevant verified scope and evidence.

2. Information handling

Reasonable protection of information is an operational obligation, not something achieved simply by posting a policy. Actual customer-project controls, processing locations, access permissions, retention, incident arrangements and service levels must be documented in the applicable agreement and security schedule.

Do not send credentials, customer records, personal data, vessel-security details or unredacted exploit evidence through a public enquiry form. Contact us for a suitable secure method.

3. Reporting a possible vulnerability

A monitored security contact is not yet published. Do not send exploit details or credentials through the enquiry form. Include the affected public URL or component, a concise description, when you observed it, minimal safe reproduction steps, likely impact and a way to contact you. Redact personal information, tokens and credentials from screenshots and logs. Do not include a working destructive payload.

If you unexpectedly encounter personal or confidential information, stop testing and do not browse further, copy additional records, alter data or disclose it publicly. Report what you observed using the minimum evidence necessary.

4. Testing boundaries

This notice invites good-faith reporting; it does not give general permission to access restricted areas, conduct scanning that degrades service, test customer or third-party systems, carry out social engineering, exfiltrate data or interfere with vessels, ports or operational technology. Obtain separate written authorisation defining assets, methods and boundaries before active testing beyond ordinary lawful use.

We cannot authorise activity against systems we do not control or bind a third party or authority. There is no standing cash bounty or guaranteed reward under this notice. We welcome coordination but cannot promise legal immunity for unauthorised activity.

5. Response and disclosure

We will assess reports and seek to communicate through the contact provided. Response times depend on verified impact and available information; this notice is not a 24-hour incident-response service or a contractual remediation deadline. Please coordinate publication so that risk can be assessed and addressed, without waiving any legally protected reporting right.

Actual personal-data incidents will be assessed and notified where required by law. Do not delay contacting relevant emergency services or authorities when immediate safety is at risk.

An effective date and last-updated date have not been set. Version: 1.0. These pages are draft notices for the current preview and are not a counsel-approved publication.