# Heatrail security policy (RFC 9116).
# Heatrail is an advisory, notify-only fraud-intelligence layer for e-commerce.
# Raw e-mail and phone never reach our servers; card data lives only in Stripe.
#
# We welcome coordinated disclosure and will not pursue good-faith security
# research. Please give us a reasonable window before publishing, and please do
# not run tests that would degrade a shop checkout. That is the one thing this
# product exists to protect.
#
# The same policy, byte for byte, is published at every URL in the Canonical
# set below.

Contact: mailto:security@heatrail.eu
Policy: https://heatrail.eu/security/
Preferred-Languages: en, et
Canonical: https://heatrail.eu/.well-known/security.txt
Canonical: https://api.heatrail.eu/.well-known/security.txt
Canonical: https://portal.heatrail.eu/.well-known/security.txt
Expires: 2027-03-01T00:00:00.000Z