generated: '2026-08-13'
method: searched
probe: true
source: https://databook.com/security
policy:
- https://databook.com/security
contact:
- security@databook.com
security_txt: false
bug_bounty:
  program: null
  platform: null
  note: 'No HackerOne / Bugcrowd / Intigriti program found.'
disclosure:
  channel: email
  commitment: >-
    "Researchers who identify potential vulnerabilities can disclose them confidentially to
    security@databook.com. We commit to acknowledging reports promptly and working in good
    faith to remediate validated issues."
  safe_harbor: not-stated
  response_sla: 'promptly (no numeric SLA published)'
practices:
- {claim: annual penetration testing, source: microsoft-365-app-certification}
- {claim: quarterly vulnerability scanning, source: microsoft-365-app-certification}
- {claim: documented process for identifying and risk-ranking security vulnerabilities, source: microsoft-365-app-certification}
- {claim: formal security incident response process, source: microsoft-365-app-certification}
- {claim: breach notification to supervisory authorities and affected individuals within 72 hours, source: microsoft-365-app-certification}
evidence:
- {source: 'https://databook.com/security', kind: disclosure-page, status: 200}
- {source: 'https://learn.microsoft.com/en-us/microsoft-365-app-certification/teams/databookai-databook', kind: publisher-attestation, status: 200}
- {source: 'https://api.databook.com/.well-known/security.txt', kind: security.txt, status: 404}
- {source: 'https://databook.com/.well-known/security.txt', kind: security.txt, status: 404}
note: >-
  Databook runs a real, email-based coordinated disclosure channel and publishes it on
  databook.com/security, but serves no RFC 9116 /.well-known/security.txt — so an automated
  scanner cannot find the contact. A second historical address, security@trydatabook.com,
  appears in the privacy policy and subscriber agreement (trydatabook.com is Databook's
  former domain); security@databook.com is the current published address.