Security

Vulnerability disclosure

If you believe you've found a security vulnerability in creavio, please email [email protected]. Reports in plain English are fine — we don't require a template.

What to expect:

• Acknowledgment within 72 hours of your report.
• A first-pass triage and severity assessment within 5 business days.
• Remediation targets by severity: Critical within 7 days, High within 30 days, Medium within 90 days, Low at our discretion.
• A status update at least every two weeks while a report is open, and a final note when the fix ships.
• Public credit (with your permission) on this page once the fix is live.

Safe harbor

We support good-faith security research. If you discover and report a vulnerability in line with this policy, creavio will not pursue or support legal action against you, and will work with you to understand and resolve the issue quickly.

To stay inside good-faith research:

• Don't access, modify, or download data that isn't yours. If you stumble on another tenant's data, stop and report it.
• Don't run automated scanners against production. Manual proof-of-concept testing is fine.
• Don't run denial-of-service or sustained brute-force tests. A few requests to prove a concept is fine.
• Don't social-engineer creavio staff, customers, or vendors.
• Give us a reasonable window to fix before public disclosure — typically 90 days, longer if needed for a complex fix.

If you're unsure whether something is in scope, ask first at [email protected]. We'd rather you ask.

Scope

In scope:

• creav.io and all of its subdomains (app.creav.io, api.creav.io, custom tenant domains).
• The creavio Cloudflare Worker API and SvelteKit dashboard.
• Tenant-owned public pages served from creavio (galleries, collections, canvas sites, public profiles).

Out of scope:

• Third-party services we use as sub-processors (Stripe, Cloudflare, Resend, Anthropic, etc.) — please report those upstream.
• Social-engineering, physical security, and lost / stolen devices.
• Reports that require a victim to install malicious software or browser extensions.
• Best-practice findings without a working proof-of-concept (e.g. "you should add header X" without showing impact).
• Self-XSS or attacks that only affect the reporter's own session.

Security practices

A factual list of what we actually do today. The full breakdown lives on the Trust Center.

External audit

creavio has not yet completed an external penetration test or SOC 2 audit. We're planning our first independent penetration test once we cross 100 paying customers, and a SOC 2 Type II report after that. We'll post a redacted summary here when each is complete.

Acknowledgments

Thank you to the researchers who have helped make creavio safer. We'll list reporters here (with their permission) as fixes ship.

No public reports yet.

Contact