Security & Responsible Disclosure

1 · Infrastructure security

Mikronomy runs on hardened EU-resident infrastructure with network-level isolation between production, staging and corporate environments. All data in transit is protected by TLS 1.3 with modern cipher suites; all data at rest is encrypted under AES-256. Keys are managed by a hardware security module and rotated on a documented schedule.

2 · Account security

Every Mikronomy account requires multi-factor authentication to log in. Suspicious sessions are challenged with step-up authentication. Session cookies use SameSite=Lax, Secure and HttpOnly flags, and all state-changing actions require a per-session CSRF token.

3 · Audits and compliance

The platform is reviewed quarterly against ISO 27001-aligned controls by an independent cybersecurity firm. Penetration tests are run at least twice a year. A public summary of each audit is available on request to institutional partners.

4 · Report a vulnerability

Security researchers who identify a vulnerability in Mikronomy are invited to submit a confidential report by email. Please include a proof of concept, reproduction steps, expected and observed behaviour, and any relevant request / response pairs.

• Email: [email protected]
• PGP key: /.well-known/pgp-key.txt
• Response window: initial acknowledgement within 48 hours; full triage within 10 business days.

5 · Scope

In scope: mikronomy.com, app.mikronomy.com, api.mikronomy.com and native mobile apps once released. Out of scope: our marketing partners, third-party exchanges, broker dashboards, and any denial-of-service testing against production endpoints.

6 · Safe harbour

Mikronomy will not pursue legal action against researchers who act in good faith, respect user privacy, and refrain from publishing details before we have had a reasonable opportunity to remediate the issue. Severe findings are eligible for discretionary bounty payments.

7 · Hall of fame

With their consent, we credit researchers who reported valid issues. The current list is maintained inside this page and updated quarterly. Thank you to everyone who has helped keep the platform safe.

8 · Policy history

This responsible disclosure policy was last revised on 1 November 2026. Earlier versions are available on request.