generated: '2026-08-12'
method: searched
source: https://www.sourcepoint.com/trust-and-security/
program:
  type: security-contact
  formal_policy: false
  bug_bounty: false
  safe_harbor: null
  note: Sourcepoint publishes a named channel for security reports on its public trust page, but no vulnerability
    disclosure POLICY document, no bounty program (no HackerOne / Bugcrowd / Intigriti listing found)
    and no /.well-known/security.txt on any host.
contacts:
- purpose: security
  email: informationsecurity@sourcepoint.com
  quote: All security related inquiries should be directed to informationsecurity@sourcepoint.com
  source: https://www.sourcepoint.com/trust-and-security/
- purpose: privacy
  email: privacy@sourcepoint.com
  source: https://www.sourcepoint.com/trust-and-security/
practices:
- Annual penetration testing conducted by an independent third party
- Network and application vulnerability scanning
- Monthly patching of high and critical severity vulnerabilities
- Documented Incident Response program with at least annual staff training on reporting security weaknesses
  and vulnerabilities
- Customer notification process stated to meet or exceed regulatory requirements
- Application code peer reviewed for quality and security; OWASP Top 10 prevention in web applications
security_txt:
  present: false
  probed:
  - https://www.sourcepoint.com/.well-known/security.txt (404)
  - https://cdn.privacy-mgmt.com/.well-known/security.txt (403)
  - https://portal.sourcepoint.com/.well-known/security.txt (200 SPA shell, not a document)
  - https://docs.sourcepoint.com/.well-known/security.txt (404)
  - https://sourcepoint-public-api.readme.io/.well-known/security.txt (404)
  recommendation: Publishing RFC 9116 security.txt at https://www.sourcepoint.com/.well-known/security.txt
    pointing at informationsecurity@sourcepoint.com would make the existing channel machine-discoverable.