Report a security problem.

How to report

Email us at security@checkmatefinancialgroup.com and include:

• What you found and where (the address, page or API route).
• Steps to reproduce it, as short as you can make them.
• What an attacker could do with it.
• How we can reach you, and how you would like to be credited, if at all.

Please do not include real customer or agent data in your report. Describe what you saw instead.

What we promise

• We will confirm we received your report within 3 business days.
• We will tell you whether we have confirmed the problem within 10 business days.
• We will keep you updated until it is fixed, and tell you when it is.
• We will not take legal action against you for research that follows this policy.
• If you want credit, we will thank you by name once the problem is fixed. We do not run a paid bounty program at this time.

What is in scope

• checkmatefinancialgroup.com and its subdomains.
• The Checkmate agent portal and the Checkmate Partner API.
• The Checkmate phone application.

What is out of scope

• Systems run by other companies, including our vendors and hosting providers. Please report those to the vendor.
• Systems we operate for clients under their own agreements.
• Denial of service, load testing, spam, and social engineering of our staff or agents.
• Physical attacks.
• Reports that only describe missing best practice with no way to exploit it.

Rules for research

• Only use accounts you own or that we gave you. Do not access, change, copy or delete other people’s data. If you reach someone else’s data by accident, stop, do not keep it, and tell us.
• Stop once you have shown the problem exists. Do not use it to look around.
• Do not run automated scans that put load on production systems.
• Give us a reasonable time to fix the problem before you tell anyone else. We ask for 90 days, and will talk with you if we need longer.

Thank you for helping keep our agents and their customers safe.