Security & reporting

Email security@centranetispbilling.com with the subject “Security report” and a concise description. Include the affected public URL or module, the approximate time and timezone, steps to reproduce and the likely impact. If the issue affects your account, include its workspace reference.

Do not email passwords, API keys, one-time codes, full payment credentials or unnecessary subscriber data. Describe the type of evidence you have and ask for a suitable secure transfer method when sensitive evidence is necessary.

Use a trusted device to change exposed passwords, revoke or rotate affected credentials through the issuing provider and remove unauthorized users where you can safely do so. Contact us promptly so we can help investigate platform access. Contact the payment provider directly for suspected payment fraud or an unauthorized transfer.

Record relevant references and timestamps. Preserve evidence without sharing it publicly or continuing intrusive activity. A password reset alone does not necessarily revoke every external API token or secure a compromised router.

Permission to use the platform is not permission to perform intrusive penetration testing. Request written authorization before scanning, exploiting or testing production systems. Do not access another tenant’s information, disrupt services, attempt credential attacks, install persistence, exfiltrate records or test social engineering against staff or customers.

If you inadvertently encounter sensitive information, stop, retain only the minimum evidence needed to explain the issue and report it privately. This page does not create a paid bounty program, blanket testing authorization or immunity for unlawful conduct.

We assess reports for scope, reproducibility, severity and affected services, and coordinate mitigation and communications appropriate to the incident. We may request additional evidence and will avoid disclosing another customer’s information in a response.

Confirmed personal-data incidents are handled under applicable legal and contractual notification obligations. We do not promise that every report is a breach or that all incidents can be resolved within a fixed time. Contact us again with the original reference if urgent evidence changes.

Workspace permissions, authentication, provider credentials and router access must be configured and maintained carefully by the responsible administrators. Use unique passwords, available multifactor protections, current supported software, appropriate backups and prompt staff offboarding.

Security controls reduce risk; they cannot make software unhackable or guarantee zero downtime. This page does not claim ISO certification, a completed independent penetration test or a contractual uptime level. Request service-specific evidence for your procurement or risk review.

Report impersonation, phishing, unlawful content, unauthorized messaging or suspected data misuse using the same contact, with the relevant sender, URL or message reference. Do not forward live credentials. Privacy complaints can also be raised through the Privacy Policy, and regulatory or legal reporting rights remain available.