Security

Last updated: 30 August 2026
In force from: 30 August 2026
About: 5 minutes to read

How Deimr is built and defended, and how to tell us when we have got it wrong.

The basics

What this means

TLS everywhere, encrypted at rest, card data never touches our servers, and admin access is logged.

All traffic runs over TLS 1.3. Data at rest is encrypted with AES-256. Card payments use Whop checkout. Full card details are never stored on our infrastructure.

Access inside Deimr is role-based. Reading a flagged conversation, opening a customer record, adjusting a points balance and holding a payout are all written to an audit log that administrators cannot edit.

Your account

What this means

Turn on two-factor. It is the single thing that matters most and it takes a minute.

We support two-factor authentication by app or SMS, and we recommend the app. Engineers handling payouts are required to use it.

We will never ask you for your password, and no Deimr engineer will ever ask for the passcode to your device by message. When a device is posted in, the passcode is requested through a one-time link that expires.

Reporting a vulnerability

What this means

Tell us at security@deimr.com. Encrypt sensitive reports with Deimr's public PGP key, verify the fingerprint first, and we answer within two working days.

Report to security@deimr.com. Program metadata is published at https://deimr.com/.well-known/security.txt. For sensitive reports, download Deimr's public PGP key from https://deimr.com/.well-known/deimr-security-pgp.asc, verify its fingerprint (AA4D0CEB2B9F9DD646CAD9DA8DC0245FE7696D1F), and encrypt logs, tokens, proof-of-concept details or customer data before attaching them.

We acknowledge vulnerability reports within two working days and give you a decision within ten.

We will not pursue legal action against researchers acting in good faith who avoid privacy violations, service degradation and data destruction, and who give us reasonable time before publishing.

Rewards run from EUR150 for a meaningful finding to EUR5,000 for anything that exposes customer data or takes payments. Duplicate reports get credit but not payment.

Severity	Example	Reward
Critical	Remote code execution, payment manipulation, mass data access	EUR2,000 - EUR5,000
High	Account takeover, privilege escalation into admin	EUR800 - EUR2,000
Medium	Stored XSS, IDOR exposing another user's record	EUR300 - EUR800
Low	Missing headers, self-XSS, rate-limit gaps	EUR150 - EUR300

When something goes wrong

What this means

72 hours to tell you, and we say what actually happened rather than that an incident occurred.

If a breach puts your rights at risk we notify the supervisory authority within 72 hours and tell affected people directly.

The notice will say what was taken, when, what we have done, and what you should do. We will not describe a data breach as a security incident involving certain information.

The basics

What this means

TLS everywhere, encrypted at rest, card data never touches our servers, and admin access is logged.

All traffic runs over TLS 1.3. Data at rest is encrypted with AES-256. Card payments use Whop checkout. Full card details are never stored on our infrastructure.

Your account

What this means

Turn on two-factor. It is the single thing that matters most and it takes a minute.

We support two-factor authentication by app or SMS, and we recommend the app. Engineers handling payouts are required to use it.

Reporting a vulnerability

What this means

Tell us at security@deimr.com. Encrypt sensitive reports with Deimr's public PGP key, verify the fingerprint first, and we answer within two working days.

We acknowledge vulnerability reports within two working days and give you a decision within ten.

We will not pursue legal action against researchers acting in good faith who avoid privacy violations, service degradation and data destruction, and who give us reasonable time before publishing.

Rewards run from EUR150 for a meaningful finding to EUR5,000 for anything that exposes customer data or takes payments. Duplicate reports get credit but not payment.

Severity	Example	Reward
Critical	Remote code execution, payment manipulation, mass data access	EUR2,000 - EUR5,000
High	Account takeover, privilege escalation into admin	EUR800 - EUR2,000
Medium	Stored XSS, IDOR exposing another user's record	EUR300 - EUR800
Low	Missing headers, self-XSS, rate-limit gaps	EUR150 - EUR300

When something goes wrong

What this means

72 hours to tell you, and we say what actually happened rather than that an incident occurred.

If a breach puts your rights at risk we notify the supervisory authority within 72 hours and tell affected people directly.

The notice will say what was taken, when, what we have done, and what you should do. We will not describe a data breach as a security incident involving certain information.

The basics

What this means

TLS everywhere, encrypted at rest, card data never touches our servers, and admin access is logged.

All traffic runs over TLS 1.3. Data at rest is encrypted with AES-256. Card payments use Whop checkout. Full card details are never stored on our infrastructure.

Your account

What this means

Turn on two-factor. It is the single thing that matters most and it takes a minute.

We support two-factor authentication by app or SMS, and we recommend the app. Engineers handling payouts are required to use it.

Reporting a vulnerability

What this means

Tell us at security@deimr.com. Encrypt sensitive reports with Deimr's public PGP key, verify the fingerprint first, and we answer within two working days.

We acknowledge vulnerability reports within two working days and give you a decision within ten.

We will not pursue legal action against researchers acting in good faith who avoid privacy violations, service degradation and data destruction, and who give us reasonable time before publishing.

Rewards run from EUR150 for a meaningful finding to EUR5,000 for anything that exposes customer data or takes payments. Duplicate reports get credit but not payment.

Severity	Example	Reward
Critical	Remote code execution, payment manipulation, mass data access	EUR2,000 - EUR5,000
High	Account takeover, privilege escalation into admin	EUR800 - EUR2,000
Medium	Stored XSS, IDOR exposing another user's record	EUR300 - EUR800
Low	Missing headers, self-XSS, rate-limit gaps	EUR150 - EUR300

When something goes wrong

What this means

72 hours to tell you, and we say what actually happened rather than that an incident occurred.

If a breach puts your rights at risk we notify the supervisory authority within 72 hours and tell affected people directly.

The notice will say what was taken, when, what we have done, and what you should do. We will not describe a data breach as a security incident involving certain information.