# Cybersecurity incident reporting | WithEquus

Canonical: https://www.withequus.com/en/cybersecurity

If there is any discrepancy between versions, the Spanish version prevails and is the applicable version. Translations into other languages are provided solely to facilitate understanding.

1. Purpose and contact

This page explains how to responsibly report potential security issues affecting WithEquus, its platform or services. Our goal is to coordinate quickly and reduce any impact on users, riding schools, providers and third parties.

WithEquus is operated by EQUUS THE HORSING APP, S.L., Spanish tax ID B-22810535, with registered office at C/Ginzo de Limia 53, 17th floor, door A (28034, Madrid, Spain). Report a potential incident at [administracion@withequus.com](mailto:administracion@withequus.com?subject=Cybersecurity%20report).

Do not include passwords, tokens, private keys, unnecessary personal data or third-party information. If your report contains particularly sensitive information, say so in your first email so we can arrange an appropriate channel.

2. Prior authorisation and scope

Publishing this policy does not grant general permission to access WithEquus or its systems. Before any active testing, notify us and obtain express written authorisation. Prior authorisation is required for intensive or authenticated scans, exploitation attempts, testing with real accounts, activity that may affect availability, or anything beyond passive observation of public information. Silence or an automated reply is not permission.

Your request must identify the responsible person, domains and resources in scope, dates and time windows with timezone, planned techniques, test origin where relevant, expected impact and stop measures. Do not begin until you receive written confirmation. Authorisation covers only the expressly approved scope; any extension requires new confirmation.

3. Unauthorised activity

This policy does not grant general permission to access, scan, test or remain in our systems. If we detect unauthorised activity, we may block its source, revoke accounts or access, preserve available technical evidence, notify providers and competent authorities where appropriate, and pursue applicable legal remedies. Certain conduct may have criminal consequences under applicable law.

4. Responsible research rules

Report a potential issue as soon as you have reasonable indications and keep communication open.

Limit testing to demonstrating the issue and use the fewest requests, data and permissions needed.

Use test accounts, data and environments that belong to you or were expressly provided for the research.

Stop immediately if personal, financial, confidential or other organisation’s information appears.

Keep obtained information confidential and securely delete it when no longer needed.

Follow applicable law, terms of use and the scope instructions we provide.

Do not contact users, riding schools, providers or employees to continue research without specific authorisation.

5. Suggested report information

Where possible, include a clear summary and affected asset or URL; technical description and potential impact; reproducible steps or a minimal, redacted proof of concept; approximate date and time with timezone; a test account reference without credentials; limited evidence with tokens, personal data and secrets removed; and a suggested mitigation if available.

6. Prohibited activities

Testing without prior authorisation where it may affect security, availability or data.

Denial-of-service or DDoS attacks, load or stress tests, or request flooding.

Phishing, social engineering, impersonation, deceptive calls or physical access to premises and devices.

Brute force, credential stuffing or access using credentials that are not yours.

Accessing, copying, modifying, deleting, downloading or exfiltrating more data than the minimum evidence needed.

Installing malware, establishing persistence, opening backdoors, pivoting to other systems or retaining access after confirming a finding.

Testing third-party infrastructure not expressly included in the authorised scope.

Publishing, selling or sharing the issue with others before agreeing on coordinated disclosure in writing.

7. Review and coordination

We will review good-faith reports, may request more information and will assess priority based on likelihood and impact. We will work to acknowledge receipt and coordinate reasonable measures, but do not guarantee a response, fix or disclosure timeline. If you encounter sensitive information, stop testing, do not share it and email us immediately with a minimal description.

8. Rewards and recognition

WithEquus does not offer a financial rewards programme or promise compensation, employment or public recognition for submitting a report. Any recognition may only be expressly agreed in writing before publication.

9. Responsible disclosure

Do not publicly disclose a vulnerability or its evidence while it is under review or remediation. Any disclosure date, scope or format must be agreed in writing in advance, considering the protection of affected people, data and related systems. This policy may be updated; the version published on this page applies to new reports.