generated: '2026-08-11'
method: searched
source: https://www.creatoriq.com/legal/security
probe: true
policy:
- https://www.creatoriq.com/legal/security
contact:
- security@creatoriq.com
bug_bounty:
  program: null
  platform: null
  note: >-
    No public bug bounty and no formal published vulnerability disclosure policy (no security.txt, no
    /responsible-disclosure page, no HackerOne/Bugcrowd/Intigriti listing found). What CreatorIQ does
    publish is a security policy page carrying a named security contact address, plus a statement that
    quarterly third-party penetration tests are run at application and infrastructure level.
practices:
  penetration_testing: quarterly, third-party, application and infrastructure level
  encryption_in_transit: TLS 1.3 with a modern cipher suite, TLS 1.2 minimum
  encryption_at_rest: AES-256 or better (AWS KMS)
  credential_storage: hashed and salted
  hosting: Amazon Web Services, multiple availability zones
evidence:
- source: https://www.creatoriq.com/legal/security
  http_status: 200
  kind: security-policy-page
  matched:
  - security@creatoriq.com
  - ISO/IEC 27001:2022
  - Penetration Tests
- source: https://www.creatoriq.com/.well-known/security.txt
  http_status: 404
  kind: security.txt
  matched: []
gaps:
- No RFC 9116 /.well-known/security.txt served on creatoriq.com, apis.creatoriq.com, apidocs.creatoriq.com or app.creatoriq.com (all 404/403).
- No safe-harbour statement or published disclosure timeline.