Security
Vulnerability Disclosure Policy
We welcome reports from security researchers. If you have found a vulnerability in Finn, this page explains what is in scope, how to report it, and what you can expect from us in return.
Last updated: October 16, 2026
Our commitment
Good-faith research, met in good faith
Security is part of how Finn is built, and independent researchers are part of how it stays that way. We investigate every credible report, keep you updated, and fix confirmed issues on a timeline set by their severity. We do not currently operate a paid bug-bounty program, but we are grateful for responsible disclosure and will credit researchers who wish to be acknowledged.
Scope
What’s in scope
In scope
- The Finn web application, dashboard and inbox (hirefinn.ai and its subdomains, including chat.hirefinn.ai)
- Finn's public APIs, webhooks and authentication flows, including the WhatsApp connection flow
- The website chat widget script, tested on a page you control
- Finn-operated services on other hostnames, such as the Rep Parallel Dialer's API
- Issues that expose Customer Data (including call recordings, transcripts and chat messages), allow access across workspaces, privilege escalation or toll fraud, or bypass access controls
- AI agents: prompt injection or tool misuse that exposes another customer's data, secrets or system access
Out of scope
- Denial-of-service (DoS/DDoS) or volumetric/load testing
- Social engineering, phishing, or physical attacks against staff or facilities
- Findings in third-party services or subprocessors (report those to the vendor), including WhatsApp and Facebook Login (report to Meta) and carrier networks
- AI agent answers that are wrong, off-script or offensive with no security impact (tell us at [email protected])
- Unwanted calls or messages from a business that uses Finn: not a security issue — see our Communication Terms
- Spam, missing best-practice headers, or reports with no demonstrable security impact
Safe harbor
We won’t come after good-faith research
If you make a good-faith effort to comply with this policy during your research, we will consider it authorized, will not pursue or support legal action against you, and will work with you to understand and resolve the issue quickly. Good faith means: you avoid privacy violations and service disruption, you only interact with accounts you own or have explicit permission to test, and you do not access, modify, or retain data belonging to others. Good faith also means you do not place calls or send SMS, WhatsApp messages or emails to numbers or addresses you do not own, or generate traffic that costs money (such as calls to premium-rate numbers); you do not test against our customers’ websites, WhatsApp numbers or AI agents; and if you come across personal data such as recordings or messages, you stop, do not keep it, and tell us at once.
Reporting
How to report
Email [email protected] with:
- • A clear description of the vulnerability and its impact
- • Steps to reproduce, including affected URLs or endpoints
- • Any proof-of-concept, logs, or screenshots that help us confirm it
We ask that you allow up to 90 days from your report before any public disclosure — we’ll coordinate timing with you.
What to expect
Our response
Acknowledged
We confirm receipt of your report within three business days.
Investigated
We triage and validate the issue, and keep you updated as we work.
Remediated
Confirmed issues are fixed on a timeline set by severity, then disclosed in coordination with you.
Version history
- Reports now go to [email protected].
- Scope covers chat AI agents and the parallel dialer.
- Set the 90-day disclosure window; consistency review.
The exact text of every earlier version is kept on record and available on request at [email protected].
Get started
Hire Finn and scale with confidence.
Move from idea to live voice automation — securely, reliably, and without operational risk.
Fort-nightly Launches
We move quickly and get you what you need
Powerful Tools
Pre-built dashboards, reports, automations, more