Version 1.4 · Effective October 7, 2026
PlatformOne Group Inc ("PlatformOne," "we," "us") builds and operates ComplianceONE. We welcome reports of security vulnerabilities from researchers, customers and anyone else who finds one. This page is our vulnerability disclosure policy: how to reach us, what is in scope, how we protect good-faith research, and what you can expect after you report.
1. Report a vulnerability
Email security@platformoneinc.com. Our security team monitors this address every business day. Our machine-readable contact file is at /.well-known/security.txt.
Please include:
- the affected URL, endpoint or component;
- the steps to reproduce, with any proof-of-concept code or screenshots;
- what an attacker could achieve, as you understand it; and
- how to contact you, and whether you would like to be credited.
Please do not include other people's personal data or customer data in your report. If you came across any, tell us what you saw rather than sending it.
2. Scope
In scope
- The ComplianceONE web application and its API.
- Websites we operate under complianceone.ai, including this one.
Out of scope
- Denial-of-service testing, load testing and spam.
- Social engineering or phishing of our staff or customers.
- Physical attacks against our offices or our providers' facilities.
- The underlying cloud platform and third-party services we use. Please report those to the provider that operates them.
3. Safe harbor
We authorize good-faith security research that follows this policy, and we will not pursue legal action against you for it. Good faith means you:
- do not violate anyone's privacy, and access no customer's data beyond the minimum needed to show the vulnerability;
- do not modify or destroy data, and do not degrade the service for anyone else;
- use only accounts you own or have permission to use; and
- give us a reasonable time to fix the issue before you disclose it publicly.
If you are unsure whether something you plan to do is within this policy, email us first.
4. What to expect
- Acknowledgement within 3 business days of your report.
- Evaluation within 5 days of your report: we confirm the issue, decide whether it is reachable from the internet and likely exploitable, and rate its potential impact on our customers from N1 (lowest) to N5 (highest).
- Risk reduction within the timeframes below, counted from evaluation. By each deadline we will have lowered the vulnerability's impact rating by at least one step, by mitigating it or fixing it. The same timeframe then applies to the new rating until the vulnerability is fully mitigated or fixed.
- Resolution notice to you when the fix is in place, and agreement with you on the timing of any public disclosure.
| Impact rating | Likely exploitable, reachable from the internet (LEV + IRV) | Likely exploitable, not reachable from the internet (LEV + NIRV) | Not likely exploitable (NLEV) |
|---|---|---|---|
| N5 | 2 days | 4 days | 16 days |
| N4 | 4 days | 8 days | 64 days |
| N3 | 16 days | 32 days | 128 days |
| N2 | 48 days | 128 days | 192 days |
These are the timeframes FedRAMP sets for a Class C certification in its Vulnerability Detection and Response rules. The impact rating reflects the potential impact on our customers if the vulnerability were exploited; we may also record a CVSS score. N1 issues are fixed during routine operations. Vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog are fixed by the catalog's due date, even if we have already mitigated them.
If we miss a timeframe, the vulnerability is reported as overdue, with the reason, in our monthly vulnerability report to our federal customers and FedRAMP. Anything not fully mitigated or fixed within 192 days of evaluation is recorded as an accepted vulnerability and reported with the reason.
We publish details of a vulnerability only when doing so is unlikely to lead to its exploitation, and we will not name you without your agreement.
5. How we review this program
Every report enters the same response process as findings from our own scanning. Our Information System Security Officer reviews how well the program is working every three months: how many reports arrived, how fast we acknowledged, evaluated and fixed them, and what caused them, and we change the program based on what we find.
6. Changes to this policy
We post any change on this page with a new version number and effective date. The contact file at /.well-known/security.txt always points here.
7. Contact
- Security reports: security@platformoneinc.com
- Company: PlatformOne Group Inc, 14154 Coble Laskey Ct, Centreville, VA 20121
- Website: https://complianceone.ai
Trust Center · Services · Changes · Status · Secure Configuration Guide · Programmatic access · Security