Report a security vulnerability
Effective November 8, 2026
How to reach us
Write to [email protected] with “Security vulnerability” as the subject. Describe what you found, the address or screen involved, the steps to reproduce it and what an attacker could gain. A screenshot helps; a password, our customers’ data or a large file does not. We read French and English.
The same details are published for automated tools in /.well-known/security.txt.
In scope
- The fleetnord.com website, its demo and its public pages.
- The FleetNord platform: each customer company’s space (
<company>.fleetnord.com), the customer portal, the punch clock and the mobile app.
Out of scope: our providers’ services (hosting, e-mail, text messages, telematics), which run their own programs, and reports without a demonstrated impact (missing headers with no consequence, software versions, attacks that need an already compromised device).
What we commit to
- An acknowledgement within three business days, then news at least weekly until it is fixed.
- A serious vulnerability is fixed first, usually within days; we tell you when the fix is live.
- If personal information may have been affected, we notify our customers and, where required, Québec’s Commission d’accès à l’information, as Law 25 requires.
- With your consent, we thank you publicly once the vulnerability is fixed. We do not offer monetary rewards.
Good-faith research
We will take no action against anyone who follows these rules:
- Use only your own accounts or the demo; stop as soon as you see data that is not yours, do not keep it, and tell us.
- No denial of service, no mass sending, no phishing or manipulation of our staff or customers, no physical access.
- Do not change or delete any data; leave no back door.
- Keep the vulnerability confidential until it is fixed, or for 90 days after your report if we have not fixed it by then, unless we agree otherwise.