Responsible Disclosure Policy

Coordinated Vulnerability Disclosure

Document Version: ALL-RDP-v1.0.0 / Legal Pack Version: ALL-LP-v1.0.0

Effective Date: 26 October 2026 | Last Updated: 26 October 2026

1. Introduction

1.1 Purpose

All360 Technology S.A., a company incorporated in the Republic of Panama ("ALL", "we", "us", "our"), operates the ALL Platform, ALL360 Devices, ALL360 OS, ALL Control Tower, the ALL Marketplace, and related services (collectively, the "Platform"). The security of the Platform, of Node Operators, Business Customers, Developers, and Users, and of the networks to which ALL360 Devices are connected is a priority for ALL.

ALL360 Devices and ALL360 OS licences are sold and licensed by Allecosystem Technologies LLC, a company incorporated in the United Arab Emirates (the "Seller"). In respect of the sale, delivery, return, refund, and warranty of ALL360 Devices and the grant of ALL360 OS licences, references to "ALL" include the Seller.

This Responsible Disclosure Policy ("Policy") explains how security researchers and other members of the public ("Researchers", "you") can report potential security vulnerabilities to ALL, what ALL commits to in response, and the conditions under which ALL will treat security research as authorised.

1.2 Relationship to Other Documents

This Policy operates alongside the ALL Platform Terms of Use, the Acceptable Use Policy ("AUP"), the Node Operator Master Agreement, and the ALL Developer License Agreement. To the extent of any conflict regarding security research conducted in full compliance with this Policy, this Policy prevails, as set out in Section 6.

2. Scope

2.1 In-Scope Assets

The following assets are within the scope of this Policy:

• ALL360 OS, including secure boot, firmware verification, update mechanisms, sandboxed service execution, and disk encryption implementations, when tested on an ALL360 Device that you own;
• ALL360 Device hardware security features, when tested on an ALL360 Device that you own;
• ALL Control Tower, including Node enrollment, telemetry, workload allocation, and billing interfaces;
• The Platform dashboard, Developer Portal, ALL Marketplace, SDK, and public APIs;
• ALL CONNECT and other ALL-published applications;
• Websites and web services operated by ALL under the domains all.is.one and its subdomains.

2.2 Out-of-Scope Assets

The following are outside the scope of this Policy:

• Apps published in the ALL Marketplace by third-party Developers, except where the vulnerability arises from the Platform, the SDK, or ALL's sandboxing or permission model (vulnerabilities in third-party Apps should be reported to the relevant Developer; ALL may assist in forwarding the report);
• Infrastructure, services, or products of third parties, including PSP/VASP providers, KYC providers, hosting providers, and ISPs;
• ALL360 Devices, Nodes, accounts, or systems that you do not own or are not expressly authorised to test;
• Physical premises, offices, warehouses, and personnel of ALL.

2.3 Excluded Findings

The following are generally not considered qualifying vulnerabilities unless accompanied by a demonstrable security impact:

• Reports generated solely by automated scanners without validation;
• Missing security headers, cookie flags, or best-practice configurations without a demonstrated exploit;
• Clickjacking on pages without sensitive actions, logout CSRF, and self-XSS;
• Rate-limiting issues that do not lead to account compromise or material abuse;
• Software version disclosure, banner grabbing, or descriptive error messages without further impact;
• Vulnerabilities requiring physical access to an unlocked device owned by the victim, or a rooted or jailbroken device;
• Issues already known to ALL or previously reported by another Researcher.

3. Rules of Engagement

3.1 Permitted Conduct

When conducting security research under this Policy, you must:

• Act in good faith and only for the purpose of identifying and reporting vulnerabilities to ALL;
• Use only test accounts that you have created, or accounts for which you have the express permission of the account holder;
• Limit testing to the minimum necessary to demonstrate the vulnerability;
• Stop testing and report immediately upon gaining access to any data that is not your own, including personal data, Session data, telemetry, billing records, or Traffic Content;
• Comply with all applicable laws.

3.2 Prohibited Conduct

You must not:

• Conduct denial-of-service, flooding, resource exhaustion, or load testing against the Platform or any Node;
• Access, intercept, modify, download, retain, or destroy data belonging to others, including Traffic Content transmitted through any Node;
• Pivot from a compromised component to other systems, persist access, or install backdoors;
• Test against Nodes, ALL360 Devices, or accounts belonging to other Node Operators, Business Customers, Developers, or Users;
• Manipulate telemetry, uptime, workload allocation, earnings, payout calculations, Marketplace ratings, or referral attribution, or retain any financial benefit obtained through a vulnerability;
• Use social engineering, phishing, or physical attacks against ALL personnel, contractors, partners, or Users;
• Send spam or unsolicited messages through Platform features;
• Publicly disclose a vulnerability or any data obtained before the coordinated disclosure process in Section 5 has been completed;
• Demand payment or any other benefit as a condition of disclosing or not disclosing a vulnerability.

4. How to Report a Vulnerability

4.1 Reporting Channel

Please report vulnerabilities by email to [email protected]. ALL also publishes its contact details in a security.txt file at https://all.is.one/.well-known/security.txt.

4.2 Contents of a Report

To help ALL triage and resolve the issue efficiently, please include:

• A description of the vulnerability and its potential impact;
• The affected asset, component, URL, API endpoint, ALL360 OS version, or firmware version;
• Detailed, reproducible steps, proof-of-concept code, screenshots, or video where relevant;
• Whether you believe the vulnerability is being actively exploited;
• Your name or handle and a contact method, if you wish to be contacted or credited.

Reports may be submitted anonymously, although ALL may then be unable to follow up or provide recognition.

4.3 Language

Reports may be submitted in English. ALL will endeavour to process reports submitted in other languages.

5. Our Commitments and Disclosure Process

5.1 Response Timelines

Upon receipt of a report submitted in accordance with this Policy, ALL will endeavour to:

• Acknowledge receipt within three (3) business days;
• Provide an initial assessment, including whether the report is accepted and its severity, within ten (10) business days;
• Keep you informed of progress at reasonable intervals until the vulnerability is resolved;
• Notify you when the vulnerability has been remediated.

5.2 Severity Assessment

ALL assesses severity using the Common Vulnerability Scoring System (CVSS) or an equivalent industry methodology, taking into account the specific architecture of the Platform, the exposure of Nodes and Users, and any active exploitation.

5.3 Remediation Targets

ALL will endeavour to remediate validated vulnerabilities within the following indicative periods from validation, subject to technical complexity and the need to deploy ALL360 OS updates across the Node network:

5.4 Coordinated Disclosure

ALL follows a coordinated disclosure model. You agree not to disclose any vulnerability publicly until ALL has released a fix or ninety (90) days have elapsed from your report, whichever is earlier, unless a different period is agreed in writing. Where remediation requires more time, ALL will explain the reasons and agree a revised timeline with you in good faith. Where a vulnerability is being actively exploited, ALL may disclose it earlier to protect Users.

5.5 Notification to Users and Authorities

Where a vulnerability affects ALL360 Devices or ALL360 OS, ALL will deliver security updates through ALL360 OS update channels and may publish security advisories and, where appropriate, request CVE identifiers. Where applicable law requires ALL to notify competent authorities, computer security incident response teams, or affected persons of an actively exploited vulnerability or a security incident, ALL will do so within the required timeframe. Researcher identities will not be included in such notifications without consent unless required by law.

6. Safe Harbour

6.1 Authorisation

Security research conducted in good faith and in full compliance with this Policy is considered authorised by ALL. ALL will not initiate or support legal action against you, and will not report you to law enforcement, in respect of such research.

6.2 Contractual Waiver for Own Devices

To the extent your research is conducted in full compliance with this Policy, ALL waives any claim against you under the AUP, the Node Operator Master Agreement, or the ALL360 OS licence relating to reverse engineering, decompilation, analysis, or circumvention of technical controls on an ALL360 Device that you own, solely to the extent necessary to identify and report the vulnerability. This waiver does not extend to any use of the findings for any other purpose.

6.3 Device and Network Protection

Notwithstanding Section 6.2: (a) physical tampering with an ALL360 Device, including removal of tamper-evident seals, may void the hardware warranty in accordance with the ALL Warranty Policy; and (b) an ALL360 Device used for security research may be suspended from Node participation, deregistered, or excluded from Service Categories to protect Business Customers and the network, without affecting the authorisation granted in Section 6.1. You are encouraged to conduct research on a Device that is not enrolled as an active Node.

6.4 Third Parties and Limits

ALL cannot authorise testing of third-party systems and cannot bind any third party, including law enforcement or regulators. If a third party initiates legal action against you in connection with research conducted in compliance with this Policy, ALL will, upon request, make known that your research was authorised under this Policy. This Policy does not authorise any conduct that violates applicable law.

6.5 Uncertainty

If you are unsure whether a specific test is consistent with this Policy, please contact [email protected] before proceeding.

7. Recognition and Rewards

ALL does not currently operate a paid bug bounty programme. ALL may, at its sole discretion, offer public acknowledgement in a security hall of fame, or a reward, for valid and previously unreported vulnerabilities of significant impact reported in compliance with this Policy. Any reward is discretionary and is subject to applicable law, sanctions screening, and tax requirements. No reward will be offered to persons in sanctioned jurisdictions or on applicable sanctions lists, to current employees or contractors of ALL, or to any person who has breached this Policy.

8. Data Protection

Personal data contained in reports, and any personal data you encounter during research, will be processed in accordance with the ALL Privacy Policy. You must not retain any personal data of others obtained in the course of research and must securely delete it upon submitting your report, confirming deletion if requested by ALL.

9. Security Support Period

ALL provides security updates for ALL360 OS on each ALL360 Device model for at least the minimum period stated for each model on the Platform website and at the point of sale (the "Security Support Period"). Information about the end of the Security Support Period will be communicated in advance through the Platform dashboard.

10. Changes to This Policy

ALL may update this Policy at any time. The version in effect on the date your research is conducted applies to that research. Material changes will be published on the Platform website and reflected in the version history of this Policy.

11. Contact Information

This Policy should be read together with the ALL Platform Terms of Use, the Acceptable Use Policy, the Node Operator Master Agreement, the ALL Developer License Agreement, and the Privacy Policy, all of which are available on the Platform website.