How security researchers can responsibly report vulnerabilities in CyberPhone products and services.
Effective: July 6, 2026
We welcome responsible disclosure of security vulnerabilities from independent researchers and customers.
This policy covers our public website, customer portal, and the software interfaces of CyberPhone products. It does not authorize testing against third-party devices or networks you do not own.
Include a clear description, reproduction steps, and impact. We acknowledge receipt within 48 hours.
We will not pursue legal action against good-faith researchers who avoid privacy violations, service degradation, and data destruction, and who give us reasonable time to remediate before public disclosure.
We aim to triage within 5 business days, provide an initial assessment within 15 business days, and coordinate disclosure of a fix according to severity.
CyberPhone hardware-modified devices are sold exclusively to vetted corporate, investigative, and compliance professionals for lawful monitoring of devices the purchaser is legally authorized to monitor. Use requires legal authority under the applicable jurisdiction. We do not sell for stalking, unlawful interception, or surveillance without consent where required by law. Every request is reviewed before procurement, and all sales are conditional on acceptance of our Legal Notice.