We take the security of our website, products, and the platforms we host on behalf of our customers seriously. If you've found a vulnerability or have a security concern, this page tells you how to reach us and what you can expect in return.
How to report
Email us at the address below with as much detail as you can share — steps to reproduce, affected URL or product, your assessment of impact, and (optionally) suggested remediation.
Validate and triage within 5 business days, with a preliminary severity assessment.
Keep you informed as we remediate, including a target timeline once we understand scope.
Credit you publicly (with your permission) once the issue is resolved.
Treat your report as confidential. We never share reporter details with third parties.
What's in scope
• lifesavertech.ca and its subdomains we operate
• Software, AI agents, and platforms we have built and continue to host or manage for customers
• Public APIs published by us (e.g. our website's /api endpoints)
Out of scope
• Third-party services we use but don't operate (Vercel, Anthropic, OpenAI, VAPI, Google, Stripe, Twilio, Resend, Supabase, etc.) — please report those directly to the vendor
• Software handed off to clients that we no longer host or maintain
• Social-engineering, phishing, or physical attacks against our team or clients
• Findings from automated scanners with no demonstrated impact
• Missing best-practice headers on pages where the impact is purely theoretical
Please do not
• Publicly disclose the issue before we've had reasonable time to remediate
• Test against systems or accounts you don't have permission to test
• Access, modify, or destroy data that isn't your own
• Run automated scans or load tests that could disrupt service for legitimate users
• Demand payment in exchange for not disclosing — we will treat that as a separate matter
Bug bounty
We don't currently run a paid bug bounty program. We do acknowledge valid reports publicly (with your permission) and recognize researchers in our hall of fame as we receive valid disclosures.
Safe harbor
Lifesaver Technology Services Inc. will not pursue legal action against you for security research conducted in good faith and in accordance with this policy. If a third party initiates legal action against you for activities that are consistent with this policy, we will make this position known publicly.