Security

Security leadership

Security at Ambi Laboratories Inc. is led by Neil Agrawal, Chief Executive Officer and Security Lead, who is accountable for the security of Wink and the infrastructure it runs on and is the point of contact for security questions and vulnerability reports.

Reporting a vulnerability

If you believe you have found a security vulnerability in Wink or any Ambi Labs service, email security@ambilabs.io. Please include a description of the issue, the steps needed to reproduce it, and the impact you believe it has.

We will acknowledge your report within three business days, keep you updated while we investigate, and let you know when the issue is resolved. Please give us a reasonable amount of time to fix the issue before disclosing it publicly.

Scope

This policy covers systems that Ambi Laboratories owns and operates, including the Wink application, its APIs, its desktop and browser clients, and the ambilabs.io and trywink.io domains.

It does not cover systems owned by our customers or by the third-party providers listed on our Subprocessors page. Please report issues in those systems to their owners.

Guidelines

When researching vulnerabilities, please:

• Only access or modify data in accounts you own, and stop as soon as you encounter customer data. Do not keep, share, or use it.
• Avoid denial-of-service testing, spam, and anything that degrades service for our customers.
• Do not use social engineering, phishing, or physical attacks against our staff, customers, or offices.

Safe harbor

We will not pursue legal action against anyone who reports a vulnerability in good faith and follows this policy. We do not currently run a paid bug bounty program.