generated: '2026-09-06'
method: searched
source: https://docs.docontrol.io/docontrol-user-guide/getting-started/overview/security-privacy-and-compliance.md
provider: DoControl
providerId: docontrol
description: >-
  DoControl publishes a named security contact and states that it runs penetration testing and
  publishes self-assessments. It does NOT publish a formal vulnerability disclosure policy, a safe
  harbour statement, response SLAs, or a bug bounty programme on any public host.
contact:
  email: security@docontrol.io
  published_at: https://docs.docontrol.io/docontrol-user-guide/getting-started/overview/security-privacy-and-compliance.md
  status: 200
  observed: '2026-09-06'
security_txt:
  published: false
  note: >-
    /.well-known/security.txt returns 404 on docontrol.io, www.docontrol.io, docs.docontrol.io and
    both API hosts. The one 200 in the probe set, on status.docontrol.io, is Atlassian's own
    Statuspage-wide document (Contact security@atlassian.com, Canonical
    www.atlassian.com/.well-known/security.txt) and is not DoControl's. See
    well-known/docontrol-well-known.yml.
policy:
  published: false
  url: null
  safe_harbour: false
  response_sla: null
bug_bounty:
  programme: none
  platforms_checked:
  - HackerOne
  - Bugcrowd
  - Intigriti
  result: no public programme found
practices_claimed:
- name: Penetration testing
  source: https://docs.docontrol.io/docontrol-user-guide/getting-started/overview/security-privacy-and-compliance.md
- name: Publicly available self-assessments
  source: https://docs.docontrol.io/docontrol-user-guide/getting-started/overview/security-privacy-and-compliance.md
- name: Information Security Policy
  source: https://docs.docontrol.io/docontrol-user-guide/getting-started/overview/security-privacy-and-compliance.md
- name: Data processing addendum
  source: https://docs.docontrol.io/docontrol-user-guide/getting-started/overview/security-privacy-and-compliance.md
gap: >-
  A reachable security@ address is the minimum, and DoControl clears it. The missing pieces are
  cheap and would matter to a researcher: a /.well-known/security.txt on the main domain, and a
  disclosure policy stating scope, safe harbour and response times.