We protect agricultural operations; our own security is part of the product. If you find a vulnerability in our systems, we want to hear about it and work with you to fix it.
01How to report
Send your report to contacto@agrotechsecurity.com with the subject "Vulnerability" and include:
- A description of the issue and its potential impact.
- The affected URL, component or system.
- Steps to reproduce it or a proof of concept.
- Your name or handle and how to reach you.
You may write in English or Spanish.
02Scope
In scope: https://agrotechsecurity.com and the subdomains and applications operated by AgroTech Security.
Out of scope:
- Third-party services (hosting, CDN, email providers); report those to each provider.
- Denial-of-service attacks or load testing.
- Social engineering, phishing or physical access to offices, farms or equipment.
- Findings with no demonstrable impact, such as missing headers without an exploitation scenario.
03Research rules
- Do not access, modify or delete data that is not yours beyond the minimum needed to demonstrate the issue.
- Do not degrade the service or affect our customers or their operations.
- Do not run automated scanners at scale.
- Keep the finding confidential until we have fixed it or for 90 days after your report, whichever comes first, unless we agree on another date.
04Our commitment
- We will acknowledge your report within three (3) business days.
- We will keep you informed of our analysis and fix.
- If you act in good faith and follow this policy, we will not take legal action against you for your research.
- With your permission, we will publicly credit you once the issue is fixed.
We do not currently run a paid bug bounty program.
05How we protect the platform
- TLS encryption for communications and encryption of sensitive stored data.
- Least-privilege access and strong authentication for internal staff.
- Segmentation between field device networks and management systems.
- Regular backups and incident response procedures.
Technical details and service commitments for each customer are set out in their contract.
06Incidents affecting customers
If an incident compromises a customer's data or services, we will notify them without undue delay through the channels agreed in the contract and, where personal data is involved, the Colombian Superintendence of Industry and Commerce as required by law.