Security Policy

This policy describes our data security practices and how to report a vulnerability responsibly.

Our commitment

Empire Concierge Group LLC takes the security of the information entrusted to us seriously. This Security Policy describes the practices we follow to protect information and explains how to report a potential security vulnerability in our systems responsibly.

Data security practices

Our security practices are proportionate to the nature of our business and the information we handle. They include:

• Data minimization. We collect and keep only the information needed for the purposes described in our Privacy Policy.
• Encryption in transit. The Website is served only over HTTPS, and unencrypted requests are redirected to HTTPS.
• Minimal attack surface. The Website is a static site with no user accounts, forms, payment functions or third-party tracking scripts, and it applies restrictive browser security headers.
• Access control. Access to business systems and information is limited to people who need it for their role, using strong, unique credentials and multi-factor authentication where available.
• Trusted providers. We use established hosting, email and communications providers and review their security and data protection commitments before relying on them.
• Confidentiality. Partners and providers who receive information to coordinate services are required to use it only for that purpose and to protect it appropriately.
• Incident response. We investigate suspected security incidents promptly, take steps to contain and remediate them, and notify affected parties and authorities where required by law.

No system can be guaranteed to be completely secure. We review and improve these practices over time.

Reporting a vulnerability

If you believe you have found a security vulnerability affecting the Website or our systems, please report it to partners@empireconciergegroup.com with the subject line “Security report”. Please include:

• a description of the issue and its potential impact;
• the affected URL, system or component;
• clear steps to reproduce the issue, including any proof-of-concept; and
• your contact details, if you would like us to follow up with you.

Please do not include personal information of others in your report beyond what is strictly necessary to describe the issue.

Scope

This policy covers the Website at empireconciergegroup.com. The following are outside its scope:

• findings that rely on denial-of-service, load or volumetric testing;
• social engineering, phishing or physical attacks against our staff, partners or premises;
• vulnerabilities in third-party services or platforms that we do not control, which should be reported to the relevant provider; and
• reports based solely on automated scanner output without a demonstrated security impact.

Guidelines for researchers

When investigating and reporting a vulnerability, please:

• act in good faith and avoid harm to us, our partners, travelers and other users;
• access, modify or retain only the minimum data needed to demonstrate the issue, and stop as soon as you encounter personal or confidential information;
• avoid degrading or disrupting the Website or any connected system;
• not use a vulnerability beyond what is necessary to confirm it; and
• keep the details confidential until we have had a reasonable opportunity to address the issue.

What you can expect from us

When you report a vulnerability in line with this policy, we will:

• acknowledge your report and review it promptly;
• keep you reasonably informed of our progress, if you have provided contact details;
• work to address valid issues within a reasonable time, taking into account their severity; and
• not pursue or support legal action against you for research carried out in good faith and in accordance with this policy.

We do not currently operate a paid bug bounty program. A machine-readable summary of this policy is available at /.well-known/security.txt.

Changes to this policy

We may update this Security Policy from time to time. The current version will always be available on this page with its effective date.

Contact

Security reports and questions about this policy may be sent to:

Empire Concierge Group LLC
Email: partners@empireconciergegroup.com