Coordinated Vulnerability Disclosure (CVD) policy

If you have found a security vulnerability in one of One Data’s software products, we would like to hear about it. This policy explains what we cover, how and what you can expect form us.

Before you start:

  • One Data GmbH does not operate a bug bounty program and does not offer monetary rewards.
  • Reporting a vulnerability does not create a contract, a service level commitment or any other legal obligation on our part.
  • We may update this policy. The version published here is the one that applies.

What we promise

  • We keep every report confidential, to the extent permitted by law.
  • We do not pass your personal data to third parties without your explicit consent, except where we are legally required to do so.
  • We respond to reports that reach us through the channel below and fall within the scope of this policy, provided you have give us a way to reply.

What this policy covers

This policy applies to vulnerabilities in the software products One Data GmbH makes available to customers.

What this policy does not cover

Our company systems and environments

  • One Data’s corporate IT, including our websites, email, employee devices, internal tools and build systems
  • Demo, training and test environments operated by One Data
  • Third-party services and SaaS products that One Data uses as a customer, report those to the provider concerned

Customer environments

  • Deployments, networks and infrastructure operated by our customers
  • Issues arising from a customer’s own configuration, hardening or integration choices rather that from the product as we ship it

Findings we don not treat under this policy

  • Product versions that are no longer supported
  • Output of automated scanning tools without a demonstrated security impact
  • Missing hardening measures or best-practice headers.
  • Finding obtained through denial of service, load testing, brute force, credential stuffing or spam
  • Findings obtained through social engineering of our staff, customers or partners, or through physical intrusion

Testing authorization

This policy does not authorize testing against any system operated by One Data GmbH. If you believe you have found a vulnerability in one of our products but can only observe it on a One Data-operated environment, please describe it to us and we will reproduce it in our own test environment.

How to report

Send your report to security@onedata.ai.

Submissions can be done in English (preferred) or German language.

Please include:

  • The product and version affected:
    Product name, release version, or container image digest (if available).
    Provide an indication which part of the product is involved – does the flaw impact data products or metadata services, use case builder, workflow engines, or apps
  • Step-by-step reproduction instructions or a non-destructive proof of concept. Please include clear information on how the vulnerability can be reproduced or exploited, where necessary for verification purposes as well as information (link) about the affected instance(s).
  • An assessment of the security impact associated with the reported vulnerability, or a threat model outlining a plausible and relevant attack scenario.
  • CVSS v3.1/v4.0 scoring or Common Weakness Enumeration (CWE) identifier is helpful if you have one, but it is not required.

Anonymous reports: we accept them, and we will assess them. Please understand that without a way to contact you we cannot acknowledge your report or agree a disclosure date with you.

What we ask of you

  • Do not cause damage, and do not disrupt our services or those of our customers.
  • Do not access, modify, extract or delete data. Do not access or compromise third-party systems. If you encounter personal data or customer data, stop and delete any copy you hold.
  • Go not further than the minimum necessary to demonstrate the finding.
  • Do not share exploit code or techniques with others before the agreed disclosure date.
  • Keep the details confidential until we have agreed a disclosure date with you.

What happens next

  • Every submission is processed through a structured vulnerability management workflow:
  • Acknowledgment: Receipt of the report is acknowledged.
  • Validation: Severity evaluation, reproduction across supported branches, and impact assessment are finalized.
  • Fix and disclosure: Where we issue a fix, we aim to agree a public disclosure date with you if possible, taking into account how complex the fix is and how long customers need to deploy it. If we decide not to remediate a finding, for example because it is outside the scope set out above in this policy, already known to us, already fixed, or not a security issue, we will inform you.
  • Regulatory notifications: Where we are legally required to notify authorities about a vulnerability, we will do so.

Final commitment

We commit to not pursuing criminal charges against any individual or entity that reports a vulnerability, provided the report was made in accordance with this policy and its underlying principles. This assurance does not apply where there is identifiable evidence of criminal intent on the part of the reporting party.

Version 1.0, effective Sep 11, 2026