Security

Reporting a problem

If you think you have found a weakness in the Umberfold service or in this site, please tell us. Write to security@umberfold.cloud with what you found, where, and how to reproduce it. A machine-readable copy of this policy is at /.well-known/security.txt.

What happens next

We acknowledge a report within three working days (Japan time), tell you whether we can reproduce it, and keep you informed until it is fixed. If you want credit once it is fixed, say so and we will name you.

In scope

• this website;
• the ingest API under /v1, as described in the reference.

Ground rules

• Use your own project key and your own test files.
• If you reach another customer's data, stop, do not keep it, and tell us.
• No volume testing and no attempts to take the service down.
• No social engineering of our staff or customers.

Research that follows these rules is welcome, and we will not take action against it.

How we handle your files, in short

Connections use TLS. Each part is verified when it arrives and the whole file when it is sealed. Project keys are stored hashed. Originals are deleted 14 days after sealing. The details are in the privacy notice.

Last updated 19 August 2026