Security at Harlem Next

Harlem Next creates high-traffic web applications for our B2B clients, used by millions of unique users every day across all continents. We take the security and privacy of those users seriously, and we welcome reports from security researchers who help us keep our platforms safe.

Security lead

Our security programme is led by our Chief Information Security Officer (CISO). You can reach the security team at security@harlemnext.com.

Reporting a vulnerability

If you believe you have found a security vulnerability in one of our systems, please email security@harlemnext.com. To help us assess and reproduce the issue quickly, include:

  • The affected URL, domain, or application.
  • Clear steps to reproduce the issue, including any request and response details.
  • The impact as you understand it, and any conditions required to exploit it.

We aim to acknowledge every report within 5 business days. We will keep you informed of our progress and let you know when the issue has been resolved.

Scope

This policy covers systems owned and operated by Harlem Next, including the web and mobile applications we build for our clients, their APIs, and the infrastructure that supports them.

The following are out of scope:

  • Third-party services that we use but do not operate.
  • Social engineering of Harlem Next staff or of our users.
  • Physical attacks against our offices, equipment, or data centres.
  • Denial-of-service attacks of any kind.
  • Automated scanning that degrades the availability or performance of our services.

Safe harbor

Harlem Next will not take legal action against researchers who act in good faith and who:

  • Avoid privacy violations and do not disrupt our services.
  • Do not access or modify other users' data beyond what is strictly needed to demonstrate the issue.
  • Give us reasonable time to fix the issue before disclosing it publicly.

If you are unsure whether your testing falls within this policy, contact us before you proceed.

Data handling

Our platforms process personal data, including special-category personal data under the General Data Protection Regulation (GDPR). If you encounter any user data during your research, report it to us immediately. Do not retain, copy, or share it, and stop testing as soon as you realise that user data is involved.

security.txt

This policy is also published in machine-readable form at /.well-known/security.txt, following RFC 9116.