generated: '2026-07-18'
method: searched
probe: true
source: https://docs.depict.ai/reference/security
policy:
  - https://docs.depict.ai/reference/security
contact:
  - security-compliance@depict.ai
summary: >-
  Depict publishes a Security Policy documenting a coordinated vulnerability
  disclosure process. Reports are emailed to security-compliance@depict.ai with
  a description, reproduction steps, affected components, impact and optional
  proof-of-concept. Depict acknowledges within 2 business days and provides an
  initial assessment within 5 business days.
remediation_timelines:
  - severity: Critical
    cvss: 9.0-10.0
    target: 48 hours
  - severity: High
    cvss: 7.0-8.9
    target: 7 days
  - severity: Medium
    cvss: 4.0-6.9
    target: 30 days
  - severity: Low
    cvss: 0.1-3.9
    target: 90 days
scope:
  in_scope: [Depict platform, APIs, merchant applications, client-side SDKs]
  out_of_scope: [third-party services, physical device access, social engineering, denial-of-service]
bug_bounty: false
evidence:
  - source: https://docs.depict.ai/reference/security
    kind: security-policy-page
    keywords: [responsible disclosure, security contact, remediation timeline, cvss]