Security and responsible disclosure.

1. How we protect our services

360 AXE (ABN 86 947 578 436) is a small business. We take reasonable steps to protect our services and the information we hold, and we keep working to improve them. For Ava and avaguide.com, these steps currently include:

1. Encrypted connections. Our Ava websites and server use HTTPS, so information sent between your browser or our phone provider and our server is encrypted in transit.
2. A firewall on our server. Our server runs a firewall that limits which connections can reach it.
3. Restricted access to secrets. The files that hold our service keys and customer account settings can be read only by the server's administrator account.
4. Checked payment notifications. We check that payment notifications really come from our payment processor before we act on them. We never see or store your full card number.
5. Protected account changes. Changes to the account owner's details made by phone need a check sent by SMS to the mobile number on the account. The secret phrase you set for your account is stored in hashed form, not as plain text.
6. Established providers. We use established cloud and technology service providers for calls and messages, payments and hosting, some of them overseas (including in the United States, Malaysia and other countries), which run their own security programs.

No system is completely secure, and we can't guarantee that information will never be accessed without permission. If we become aware of a data breach that is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner where the law requires it. Our Privacy Policy explains how we handle personal information.

2. Reporting a vulnerability

If you believe you have found a security vulnerability in any 360 AXE website, app or service, including Ava, please tell us. Email security@360axe.com with "Security" in the subject line.

3. What to include

Please include:

1. a description of the issue and where you found it (web address, app name or phone number);
2. the steps needed to reproduce it;
3. what an attacker could do with it, if you know; and
4. how we can contact you.

Screenshots or a short video can help. Please do not include other people's personal information in your report.

4. Please follow these rules

When looking into a possible issue, please:

1. do not access, change, download or delete other people's data. If you come across personal information, stop and tell us;
2. do not disrupt or degrade our services, for example through denial-of-service attacks, spam or large volumes of automated calls or requests;
3. do not use social engineering, phishing or physical attacks against us, our customers or our providers;
4. only test against accounts and Ava numbers you own or have permission to use; and
5. give us a reasonable chance to fix the issue before telling anyone else about it.

Issues in services run by our cloud and technology service providers should be reported to those providers directly.

5. What we will do

We will acknowledge your report, look into it, and keep you updated on our progress. We will let you know when the issue has been fixed. If you would like to be credited, let us know and we will be happy to discuss it.

6. Good-faith research

If you act in good faith and follow the rules on this page, we won't take legal action against you for your research. We can't give permission to test systems run by our cloud and technology service providers, and this promise doesn't cover them.

7. Bug bounty

We do not offer a paid bug bounty at this time.

360 AXE · ABN 86 947 578 436 · security@360axe.com