Versio B.V. | Responsible disclosure
Version 1.0 | June 2021

We pay great attention to the safety and integrity of our systems and services. Nevertheless, a weak
spot, vulnerability, exploit or other security risk (hereinafter referred to as: 'security risk') may still bediscovered.
We ask that you report any security risks you have identified to us as soon as possible, with due
observance of the following policy. This will enable us to continuously improve the security of oursystems and services and to continue to strive to offer our clients and users the most secure experience
possible.
For this purpose, we ask that:
1. in investigating the matter:oyou do not use distributed denial of service attacks (DDoS);o

you do not make use of brutal force attacks;oyou do not post malware;oyou do not use phishing and/or hacking tools;oyou do not make changes to systems or the data stored therein;oyou do not use social engineering or attack physical security measures;oyou do not use spam;

2. in investigating the matter, you do not go beyond what is strictly required to share the security
risks with us in accordance with this policy and do not take advantage of these by – for example– accessing third-party data, overloading systems or creating a nuisance to users of the systems
in any other way;
3. you report the security risks and all your related findings in an e-mail to support@versio.nl,
containing, to the extent possible:
oas clear a description of the security risk as possible;

othe IP address or URL of the relevant system; andoa clear description of the steps that will enable us to reproduce and/or establish thefinding;4. you keep your findings strictly confidential and do not share them with others until the relevant
security risk has been remedied; and5. you delete any confidential information that has come into your possession as a result of theinvestigation as soon as the relevant security risk has been remedied.
You may expect us to:
1. not attach any legal consequences to your report, provided that, in investigating and reportingyour findings, you followed the procedure described in this policy;

Page 1 of 2

Versio B.V. | Responsible disclosure | Version 1.0 | June 2021
2. treat all reports confidentially and not share your personal data with third parties without
permission, unless we are required to do so by law or pursuant to a court ruling;
3. – if you wish, and insofar as there is going to be a public or other communication or publicationon the security risk – mention you as the person who discovered the security risk (please notethat it is possible that someone else has discovered the security risk first, without that being
disclosed at the time. In such case, the other party will be considered the party who discoveredit.);
4. respond to your report with our assessment of your findings and an expected solution datewithin seven days;
5. make every effort to resolve the security risk and keep you informed of the progress with regard
to the solution; and6. – in principle – be open to contributing to any publications on your findings after the security riskhas been remedied.
We offer no rewards for reporting security risks.

Page 2 of 2