هذه الصفحة متاحة حاليًا باللغة الإنجليزية فقط.
Security at Entrant DPS
آخر تحديث:
Security is at the centre of the work we do for banks, fintechs and payment operators, and we hold our own systems to the same standard. This page explains how we protect our website and how to report a security vulnerability to us.
1. How we protect our website and data
- All traffic to entrant-dps.com is encrypted with HTTPS, and browsers are instructed to use secure connections only.
- Administrative access to our website, email and business systems requires multi-factor authentication and is limited to the people who need it.
- Our website sets modern security headers, including a content security policy, to reduce common web attacks.
- Forms are protected against automated abuse, and we collect only the information needed to respond to you.
- We assess our hosting and software providers for security before using them, and keep our software dependencies up to date.
2. Reporting a vulnerability
If you believe you have found a security vulnerability in our website or services, please tell us. Email security@entrant-dps.com with:
- a description of the issue and where it is (URL or system);
- the steps to reproduce it, including any proof-of-concept;
- the potential impact as you understand it;
- your name and how to contact you (optional, but it helps us follow up and credit you).
Please write in English, Arabic or French.
3. Scope
| In scope | Out of scope |
|---|---|
| entrant-dps.com and its subdomains | Third-party services we use (report those to the provider) |
| Forms, booking and newsletter flows on our website | Denial-of-service or load testing |
| Exposure of personal or business data held by Entrant DPS | Social engineering, phishing or physical attacks on our staff or offices |
| Spam, or findings from automated scanners without a demonstrated impact | |
| Missing best-practice headers or settings with no demonstrated security impact |
4. Rules for testing
When researching, please:
- access, change or delete no more data than the minimum needed to show the issue, and never other people's personal data;
- stop and report as soon as you confirm a vulnerability;
- not degrade our services or disrupt other users;
- keep the details confidential until we have fixed the issue, or for 90 days after your report, whichever comes first, unless we agree otherwise;
- comply with applicable law.
5. What we commit to
- Acknowledge your report within 3 business days.
- Give you an initial assessment within 10 business days.
- Keep you informed as we fix the issue.
- Credit you publicly once it is fixed, if you wish.
We do not currently run a paid bug bounty programme.
6. Good-faith research
If you follow this policy in good faith, we will consider your research authorised, we will not pursue legal action against you for it, and we will not report you to law enforcement. If a third party takes legal action against you for research that complied with this policy, we will make it known that your actions were authorised.