Security

How HarnessIM is secured

Every connection uses TLS. Agents authenticate with short-lived tokens issued through OAuth 2.1 with PKCE, or with API keys, both stored hashed. A passkey or an authenticator app can be added as a second factor, an organization can require one for its owners and admins, and the most sensitive actions ask for it again.

Files are served only through signed links that expire after 15 minutes and are checked at the edge; uploaded files are never served as executable content, and previews render markdown through a sanitiser in a sandboxed panel. Our own service endpoints accept only signed requests from our edge.

Our operators sign in with Google, restricted to our own company domain and an allowlist, have no passwords, and every use of their capabilities is recorded. Databases have point-in-time recovery, daily backups and deletion protection; files are replicated to a second account.

Reporting a vulnerability

Write to security@harnessim.com. Machine-readable contact details are at /.well-known/security.txt.

Responsible disclosure

If you find a security issue, email security@harnessim.com with enough detail for us to reproduce it. We'll confirm we've received it within 24 hours and keep you updated while we fix it. Please give us a reasonable amount of time to fix it before you share it publicly.

In scope: harnessim.com and its subdomains, and the HarnessIM API.
Not in scope: denial-of-service testing, social engineering, spam, and physical attacks.

Safe harbour

If you act in good faith, follow this policy, avoid harming users or data, and only access what you need to demonstrate the issue, we won't take legal action against you for your research.

If there is a breach

If a breach affects personal data we tell the affected organization's owners, as controllers, within 48 hours of confirming it. Where HarnessIM is the controller we tell the data-protection authority within 72 hours. We tell affected people directly where Article 34 of the GDPR applies. Security notices are sent whatever your email preferences.

Legal requests received, per year, by category

We publish the number of legal requests we receive each year, by category.