Security Policy

Last updated: 1 November 2026. This policy is for security researchers and anyone who finds a possible vulnerability in the systems of Frandeș Law.

Reporting a vulnerability

We take the security of our systems and of the data we hold seriously. If you find a security vulnerability in our systems, please report it to us before disclosing it publicly.

Send reports to office@frandes.law. You may write in English or Romanian.

Scope

This policy covers:

• the website frandes.law and its subdomains;
• the domain companystack.cloud and its subdomains, which host the API used by this website (chat, contact form and CUI lookup) and the firm's internal systems;
• any public API or endpoint under these domains.

Out of scope: services of third parties that we use (such as hosting and AI model providers), the IT systems of courts and public registers, and any other system we do not operate.

Good-faith research

We will not file a criminal complaint and will not bring civil proceedings against researchers who meet all of the following conditions:

• the report was sent to office@frandes.law before any public disclosure;
• the research was limited to what was needed to show that the vulnerability exists and did not involve accessing, copying, changing or deleting other people's data;
• services were not disrupted (no denial-of-service attacks, spam or excessive automated traffic);
• no social engineering was used against our staff or clients;
• the 90-day disclosure period described below was respected.

This undertaking binds only Frandeș Law. It cannot prevent public authorities from acting on their own initiative where the law allows it, and it does not cover bad-faith conduct or conduct that causes actual harm.

What to include in a report

Please include:

• a description of the vulnerability and its likely impact;
• the steps needed to reproduce it, with a minimal proof of concept that contains no real client data;
• the affected addresses or components;
• an email address where we can reach you.

How we handle reports

We will acknowledge your report within 5 working days, send you our initial assessment within 15 working days and fix confirmed vulnerabilities within 90 calendar days of the report. If a fix needs more time for technical reasons, we will tell you in writing.

Once the vulnerability is fixed or the 90 days have passed, whichever comes first, you may disclose it publicly, provided the publication contains no real client data.

Rewards

We do not currently offer financial rewards (bug bounties).

security.txt

In line with RFC 9116, we publish a /.well-known/security.txt file with our security contact details in a standard format.

Contact

Security reports and questions about this policy: office@frandes.law.