Vulnerability Disclosure Policy

Introduction

Almanac Health, Inc. ("Almanac", "we", "our" or "us") builds software that clinicians use with patient information, so the security of our websites, applications, and related services (the "Services") matters to us and to the people who rely on them. We welcome reports from security researchers and anyone else who believes they have found a vulnerability, and we will work with you to understand and fix it.

This policy explains what is in scope, how to report an issue, what you can expect from us, and the rules you agree to follow when you test our Services. If you follow it, we consider your research authorized and will not pursue legal action against you (see Safe harbor below).

How to report a vulnerability

Email security@almanac.chat. Please do not report security issues through public channels such as social media, app store reviews, or public issue trackers.

A good report helps us move quickly. Please include:

• A short summary and your assessment of the severity.
• The affected URL, endpoint, app version, or component.
• Step-by-step instructions to reproduce the issue, and a proof of concept if you have one.
• The potential impact: what an attacker could do with it.
• Any suggestions you have for a fix.
• Whether you plan to disclose the issue publicly, and when.

Please send one vulnerability per report, unless several issues have to be chained together to have an impact. Reports may be written in English.

Scope

The following are in scope:

• The Almanac web application at almanac.chat, and its subdomains that we operate, including api.almanac.chat.
• The Almanac iOS application.
• Our marketing website at almanac-health.com.
• Our integrations and connectors (for example, the Google Workspace, Microsoft, and MCP connectors) as implemented by Almanac.
• AI-specific security issues with a concrete security impact, such as prompt injection that leads to unauthorized access to another user's data, actions taken on a user's behalf without their consent, or data leaving the account it belongs to.

The following are out of scope:

• Services operated by third parties, even when reached through an Almanac domain, including our authentication provider (WorkOS), payment processor (Stripe), EHR vendors (such as Epic), cloud and network providers, and Google or Microsoft services. Please report those issues to the vendor directly.
• Denial-of-service or load testing, volumetric attacks, and anything that degrades the Services for other users.
• Social engineering, phishing, or physical attacks against Almanac staff, offices, customers, or partners.
• Spam, or abuse of features that send email or messages.
• Reports from automated scanners without a demonstrated, exploitable impact.
• Missing security headers, cookie flags, or best-practice settings with no demonstrated impact.
• Clickjacking on pages with no sensitive actions, self-XSS, or issues that require an already compromised device or browser.
• Rate-limiting or brute-force observations without a demonstrated bypass that leads to account compromise.
• Our staging and development environments. Please test only the production Services.
• Content and behavior of AI model output (for example, jailbreaks, hallucinations, or harmful responses) without a security impact. We still want to hear about these. Please send them to support@almanac.chat.

If you are unsure whether something is in scope, email us before you test.

Rules for testing

To keep our users and their patients safe, you agree to:

• Never access, modify, or keep patient information or other users' data. Use only accounts you created yourself, and use test data, never real patient information. If you come across data that is not yours, stop testing immediately, do not copy or share it, delete anything you retained, and tell us right away.
• Do only what is necessary to demonstrate the vulnerability. Do not pivot to other systems, establish persistence, or exfiltrate data.
• Not degrade, disrupt, or interrupt the Services, or interfere with other users.
• Not use social engineering, phishing, or physical access.
• Not demand payment or any other benefit in exchange for reporting or withholding a vulnerability.
• Keep the details confidential until the point described under Coordinated disclosure.
• Comply with all applicable laws, and not be on, or act for anyone on, a sanctions list.

What you can expect from us

When you report in good faith under this policy, we will:

• Acknowledge your report within 3 business days.
• Give you an initial assessment within 10 business days, including whether we can reproduce the issue and how we rate its severity.
• Keep you informed as we work on a fix, and tell you when it is resolved.
• Aim to fix confirmed vulnerabilities on the following timelines from our initial assessment: critical and high severity within 30 days, medium within 60 days, and low within 90 days. Issues that are being actively exploited are handled as security incidents and fixed as fast as possible.
• Keep your identity and contact details confidential unless you ask us to share them, or the law or our agreements with customers require us to (for example, when a report involves patient information).
• If your report involves patient information, investigate it as a possible breach under our HIPAA obligations. That may mean notifying the affected customer, and we will tell you if it does.
• With your permission, credit you publicly once the issue is fixed.

Coordinated disclosure

We ask that you give us a reasonable chance to fix an issue before you share it. Please do not disclose a vulnerability publicly until we have confirmed that it is resolved, or until 90 days after our initial assessment of your report (or after the date it was due, 10 business days after your report, if that is earlier), whichever comes first. This matches the longest of our fix timelines above. If a complex fix needs more time, we will explain why before that date and ask you to agree to a later one, and disclosing on the date we agree is within this policy. We may also choose to disclose a resolved issue ourselves, and we will credit you if you would like.

Safe harbor

This section is adapted from the disclose.io standard safe harbor terms. When conducting vulnerability research according to this policy, we consider research conducted under this policy to be:

• Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;
• Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls;
• Exempt from restrictions in our Terms of Service that would interfere with conducting security research, and we waive those restrictions on a limited basis; and
• Lawful, helpful to the overall security of the Internet, and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please email security@almanac.chat before going any further.

Notwithstanding the above, these protections do not extend to: deliberately breaking the rules above; deliberately or recklessly causing harm; threats or extortion; or accessing, keeping, or sharing data that is not yours, including patient information, even accidentally, other than brief, accidental exposure or retention that you stopped, deleted, and reported right away, as the rules for testing require.

Safe harbor applies only to legal claims under our control. It does not bind independent third parties, and we cannot authorize testing of systems that third parties operate. Their own policies apply.

Rewards

Almanac does not currently run a paid bug bounty program, and we do not offer payment for reports. We are grateful for every good-faith report and will recognize your contribution if you would like.

Changes to this policy

We may update this policy from time to time. The version in effect when you submitted your report applies to that report. The date at the top of this page shows when it last changed.

Contact

Security reports: security@almanac.chat. Other questions about this policy: support@almanac.chat.