Security & Responsible Vulnerability Disclosure (B2B)

1. Overview

This page describes MarkenGroup’s security approach and how to report vulnerabilities responsibly. It is intended for business customers (B2B) and security researchers acting in good faith.

Security is an ongoing process. We implement reasonable technical and organizational measures to reduce risk, without claiming absolute security.

2. Scope (included and excluded assets)

2.1 In scope

• marken-group.com (including studio.marken-group.com)
• markengroup.eu
• markengroup.co
• markengroup.us
• markengroup.cloud
• MarkenGroup Cloud Service TrackMailer (trackmailer.io)
• MarkenGroup Cloud Service TrackAnyClick (trackany.click)
• MarkenGroup AI Studio (studio.marken-group.com)

2.2 Out of scope

• Third-party platforms and services (e.g., Google, Meta, LinkedIn, Cloudflare, Firebase/Google Cloud, AWS) beyond our direct configuration control.
• Social media accounts and content (Facebook, X/Twitter, Instagram, LinkedIn).
• Social engineering, physical threats, employee/contractor device access, or testing on the Customer’s infrastructure.
• Intentional service disruption (DDoS) or testing that degrades availability.

We currently do not offer public APIs. Scope is limited to our sites, applications and configurations under MarkenGroup control.

3. Security measures (technical and organizational)

3.1 Transport and web security

• HTTPS/TLS for websites and relevant traffic.
• Use of security headers where appropriate.

3.2 Perimeter and infrastructure protection (Cloudflare)

• DDoS protection.
• Rate limiting and bot controls.
• Firewall rules and geo rules depending on risk.

3.3 Access control

• Mandatory MFA for relevant internal/admin access.
• Role-based access control (RBAC) and separation of duties.
• Administrative access logging where applicable.

3.4 Data, isolation and backups

• Encryption in transit (TLS).
• Encryption at rest provided by cloud vendors where applicable.
• Tenant isolation for SaaS solutions.
• Backups approximately every 12 hours.

We currently do not run scheduled restore tests on a regular basis.

3.5 Secure development and operations

• Code reviews as part of delivery.
• Dependency update/patching process based on priority.
• Secrets management to reduce credential exposure.
• Monitoring and alerting depending on criticality.
• Incident response process for handling security events.

Formal internal postmortems are not performed systematically; for relevant incidents we document learnings and improvement actions.

4. Responsible vulnerability reporting

If you discover a vulnerability, please report it to: [email protected]. We appreciate clear and verifiable reports.

4.1 What to include in your report

• Affected URL/system (domain/subdomain).
• Description and security impact.
• Reproduction steps and, if possible, a safe PoC.
• Evidence (screenshots, non-sensitive logs) and timestamp.
• Your contact details for follow-up.

4.2 Response targets

• Acknowledgement: within 24 business hours.
• Initial triage: within 3 business days.
• Mitigation/fix: based on priority, typically 3–14 days.

4.3 Safe Harbor (good faith) and restrictions

We will not pursue legal action against researchers acting in good faith, minimizing impact, and reporting responsibly.

• Not allowed: extortion, threats, or demands for payment/reward.
• Not allowed: mass data exfiltration, unnecessary access to data, or persistence.
• Not allowed: DDoS or availability-degrading tests.
• Not allowed: social engineering or attacks targeting employees/contractors.

5. Customer recommendations (Shared Responsibility)

Security is shared. To reduce risk, we recommend customers:

• Use strong passwords and enable MFA where available.
• Limit access to authorized personnel and review permissions regularly.
• Protect and rotate credentials/API keys where applicable, especially if compromise is suspected.
• Maintain a technical point of contact for incident coordination.

6. Governing law and venue

This page is governed by the laws of the Republic of Colombia. Any disputes related to it shall be submitted to the courts of Medellín, Antioquia, unless expressly agreed otherwise.

7. Updates to this page

We may update this content due to technological, operational or legal changes. The current version is shown in the header.