Security

Our approach

We take reasonable technical and organizational measures to protect information. Our public website is a static site served over HTTPS through a global content delivery network with strict security headers and a restrictive content security policy, and we apply least-privilege access to our infrastructure and keep dependencies scanned and updated.

Reporting a vulnerability

Report suspected vulnerabilities to hello@sumr.co with enough detail to reproduce, and allow a reasonable time to remediate before public disclosure.

We will not pursue action against good-faith security research that respects user privacy, avoids service disruption and stays within the scope of what is needed to demonstrate the issue.

Incident response and contact

We maintain a process to assess and respond to security incidents, including notifying affected individuals where required by applicable law. Security reports: hello@sumr.co.