What we commit to
Each of these is a commitment, not an aspiration. They apply to anything in scope, in English or German, whether or not you are a customer.
- 3 working days to acknowledge a report.
- 10 working days to assess it: whether it is accepted, the severity, the CVSS vector with its reasoning, and the CWE chain.
- 90 days to disclosure, from the report or from when a fix ships, whichever comes first.
The fix target is set by severity and agreed with you when the assessment lands. Extensions are by agreement and stated publicly when the advisory goes out. If a date is going to slip, you hear before it slips, with a reason and a new date.
How to report a vulnerability
Email egelhaus@ennogelhaus.de, or file it through GAdvisory. Both reach the same person and start the same process. A PGP key for the address is published over WKD, and the machine-readable contact is at security.txt.
A useful report says what you did, what happened and what you expected instead, with a version or a commit and enough detail to reproduce it. If you have a CVSS vector in mind, send the vector rather than the number. If you are not sure it is a vulnerability, send it and say so.
Please do not open a public issue or post it in a chat channel: both are public the moment you send them. The full disclosure policy says what happens after you report.
Safe harbour
Report in good faith and we will not pursue you for it, and will not ask anyone else to.
Good faith means testing only against your own installation or an account you control, not accessing or changing anyone else's data, not degrading the service for other people, no automated scanning that amounts to a denial of service, and giving the timeline above a chance to run before going public.
By default your report ends up on the public record with you credited by the name or handle you give. Say the word and it will not be; either way you are told before publication.
What is covered
The software Gelhaus Solutions publishes and the services it runs: the GHub product line, the tools published under the Gelhaus Solutions organisation, and the hosted instances of them. For each product that is the whole of it: the source repository, the artifacts released from it and the production deployment.
- GPlatform is partly covered: the modules it ships are in scope, the platform itself is not, as it is not shipped to customers.
- Our forks (Vulnogram, Kener, Discord Tickets) are covered for the code we wrote or changed.
- Postiz is not in this scope. It has its own CVE Numbering Authority, with MITRE as TL-Root, and its own GCVE Numbering Authority; report Postiz findings there.
The scope list is authoritative. An unlisted report is still read and answered.
Where the data sits
Our services run in Germany: on our own hardware and on servers we rent from IONOS in Germany. Mail runs on our own mail server, and files are kept in our own MinIO object storage.
The providers we do use, what for and where, are on the sub-processors page of this trust centre.
Technical and organisational measures
From the record of processing ROPA-0048What Gelhaus Solutions do to keep the personal data they process for business customers safe, as their record of processing states it.
- Location: Customer Personal Data is processed in Germany, on servers that Gelhaus Solutions owns and operates on its own premises and on servers rented from IONOS SE in data centres in Germany. The Sub-processors in Schedule 3 process it as stated there.
- Physical access control: the servers of Gelhaus Solutions are on its own premises, which are not open to the public and are locked when nobody is present. IONOS secures its data centres with its own certified measures. Storage media that are no longer used are securely wiped or physically destroyed.
- System access control: every account is personal; there are no shared accounts for people. The administrative interfaces of the servers, including SSH, are reachable only from the internal network or over an encrypted VPN, and not from the internet. Administrative access to the hosted services is protected by a second factor, a passkey or a key.
- Data access control: access is granted only where the service needs it, and is removed when it is no longer needed; access is role-based and logged in an audit trail. Credentials, secrets and keys are kept in HashiCorp Vault or an equivalent encrypted secrets store, never in source code or in plain text. Each service runs with its own credentials and with the least privileges it needs.
- Separation: within each hosted service, Customer Personal Data is kept apart from the data of other customers, in its own database or instance or by separation by customer in the service's database, and is used for no other purpose.
- Encryption: every connection over a public network uses TLS 1.2 or later or an encrypted VPN. Passwords, API tokens and comparable secrets are stored as hashes rather than as values, and integration secrets are encrypted at rest. Backups are encrypted before they leave the server they are taken from.
- Minimisation: no service processes more data than it needs. Logs leave out passwords, tokens, secrets and API keys, and request logs are kept for at most 30 days.
- Input control: administrative changes to systems are attributable to a person, configuration is kept under version control, and the services keep audit logs of administrative actions where they provide them.
- Availability and resilience: systems are monitored. Security updates are applied on a schedule, and for critical vulnerabilities without undue delay.
- Backups and recovery: backups are made daily to a backup server on the premises of Gelhaus Solutions in Germany. Daily backups are kept for a few weeks and monthly backups for at most one year.
- Incident response: security incidents are handled as the clause “Personal data breaches” requires.
- Persons: at the date of this agreement, only Enno Gelhaus, the owner of Gelhaus Solutions, has access. Any other person is bound to confidentiality before receiving access, is instructed on data protection, and loses access when it is no longer needed.
- Regular testing: Gelhaus Solutions reviews the effectiveness of these measures at least once a year, after every significant change and after every incident (Art. 32(1)(d) GDPR), and gives the Customer the results on request.
- Certification: Gelhaus Solutions holds no certification of its own. It relies on the certifications and audit reports its Sub-processors make available, which it passes on to the Customer on request as far as it may.
- Data portability and erasure: the Customer can export and delete its data with the functions each hosted service provides; Gelhaus Solutions deletes as the clause “Return and deletion” provides.
Who else processes the data
8 companies process personal data for Gelhaus Solutions, each with what for, where and under which safeguard.