Security policy
The Rights Foundry takes security disclosures seriously. This page explains how to report a vulnerability, what to expect from us, and what we ask of researchers.
Scope
This policy covers therightsfoundry.com and its subdomains, The Rights Foundry API, MCP server and self-serve platform, and any systems operated by The Rights Foundry. Out of scope: third-party services we do not control, social engineering, physical security and denial-of-service attacks.
How to report
Email security@therightsfoundry.com with a description of the issue and its impact, steps to reproduce (URLs, payloads, screenshots), and your contact details if you would like a reply. We accept reports in English. PGP is not available yet. Do not include sensitive or production data.
Our commitments
| Commitment | Detail |
|---|---|
| Acknowledgement | Within 5 business days. |
| Assessment | Initial response within 14 business days. |
| Updates | We keep you informed if a fix takes time. |
| No legal action | We will not pursue legal action against good-faith researchers who follow this policy. |
| Credit | We credit researchers who report valid issues, if they wish. |
Responsible disclosure
Please give us reasonable time to fix an issue before any public disclosure; do not access, change or delete data that is not yours; do not disrupt our services or users; and do not share the issue until it is resolved.
Contact
Security: security@therightsfoundry.com. General: hello@therightsfoundry.com.
Policy updates: last updated October 2026. Material changes will carry a new date. Version 1.1.