Security and Responsible Disclosure

Information protected by Chloé

Depending on an authorised user's responsibilities, Chloé may process or display information relating to:

• User accounts and authorised roles.
• Employee onboarding and offboarding requests.
• Approval and decision records.
• Assigned devices, equipment, accessories, and service tags.
• Asset allocations, returns, handovers, and lifecycle history.
• Workflow status and operational notes.
• Account activity and administrative audit information.
• Business locations, departments, companies, and reporting relationships.

Users must only submit information necessary for an approved business purpose. Passwords, authentication codes, private keys, access tokens, banking information, identity documents, medical information, or other highly sensitive information must not be entered into general notes or uploaded unless an authorised process explicitly requires it.

Identity and account protection

Chloé applies safeguards intended to reduce unauthorised access and account misuse.

• Passwords are protected using secure password hashing and are not stored as readable plain-text passwords.
• Sign-in attempts are subject to throttling and rate controls intended to reduce automated password attacks.
• Password reset requests use protected reset information rather than exposing reusable credentials.
• Reset information is designed to expire and should not be reused after a successful password change.
• Account status controls allow authorised administrators to disable access when it is no longer required.
• Access to protected application pages requires a valid authenticated session.
• Signing out clears the active application session.
• Passwords, authenticator codes, recovery codes, and other credentials must never be shared between users.

A successful sign-in does not automatically authorise access to every part of Chloé. Access remains subject to the user's active status, assigned role, permitted routes, and applicable data visibility rules.

Administrator two-factor authentication

Privileged administrator access is protected by two-factor authentication.

Administrator verification may require:

• A valid time-based code from an approved authenticator application.
• A valid single-use recovery code where the normal authenticator is unavailable.

Protected administrator pages remain unavailable until the required verification has been completed.

Authentication attempts are restricted to reduce repeated code guessing. Recovery codes are protected, intended for one-time use, and must be stored privately. A recovery code must never be emailed, entered into a support ticket, stored in general notes, or shared with another person.

An unexpected MFA request must never be approved. Repeated or unexplained authentication prompts should be reported immediately.

Session protection

Chloé uses session safeguards intended to protect authenticated users and reduce session misuse. These include secure cookie settings, session validation, controlled sign-out handling, and restrictions on access to protected pages.

Session cookies use protections including:

• Secure transmission over HTTPS.
• HttpOnly restrictions to reduce direct script access.
• SameSite controls to reduce unintended cross-site requests.

Users should still sign out when finished, especially when using a shared, temporary, public, or remotely accessed device. Closing a browser window should not be treated as a substitute for signing out.

Role-based access control

Chloé uses role-based access controls to determine which pages, records, workflows, and administrative functions an authorised user may access.

Access decisions may consider:

• Assigned role and account status.
• Company or department responsibility.
• Management or administrative responsibility.
• Request ownership or workflow responsibility.
• Specific permission settings or approved overrides.
• The sensitivity and current stage of a workflow.

Administrative functions are restricted to authorised roles. Account roles, permissions, and active status must only be changed through approved administration processes.

Chloé also includes safeguards intended to reduce accidental administrator self-lockout when changing the currently signed-in account.

Permissions should follow the principle of least privilege. Users must receive only the access required for their approved responsibilities, and access should be reviewed when responsibilities change.

Possession of a Chloé account does not authorise a user to access another person's information, bypass a workflow, or use information for a purpose unrelated to their work.

Application safeguards

Chloé applies server-side safeguards to sensitive requests and application functions. These include:

• CSRF validation for applicable state-changing requests.
• Server-side validation of submitted information.
• Restrictions on accepted request methods.
• Parameterised database operations to reduce injection risk.
• Controlled handling of required and optional form fields.
• Validation of user, asset, workflow, and administrative identifiers.
• Protection against direct access to sensitive configuration files.
• Output and export handling intended to reduce unsafe spreadsheet formula execution.
• Controlled redirects after authentication and form processing.
• Restrictions on unauthorised access to protected application routes.

Client-side validation may improve usability, but it is not treated as the only security control. Important access and data decisions must be enforced on the server.

HTTPS and browser protections

Chloé uses HTTPS to protect information while it travels between a supported browser and the platform.

Additional browser-facing protections are used to reduce risks such as:

• Unauthorised framing and clickjacking.
• Content-type confusion.
• Insecure mixed-content loading.
• Unnecessary referrer information disclosure.
• Loading protected content through unintended contexts.

HTTPS protects information in transit, but it does not protect information after it has been copied, downloaded, photographed, forwarded, exported, or displayed on an unattended device. Users remain responsible for handling information appropriately after accessing it.

Configuration and source-code protection

Environment-specific secrets and live configuration must not be committed to the application source repository.

Chloé's source-control safeguards exclude live environment files and configuration files that may contain sensitive settings. Example configuration files should contain placeholders only and must not contain working passwords, tokens, private keys, or production secrets.

Credentials and security secrets must be stored and managed through approved protected mechanisms. Secrets must be changed promptly when exposure is suspected.

Publishing source code, screenshots, logs, or configuration information does not automatically make that information safe to share. All material must be reviewed for credentials, personal information, internal addresses, access tokens, and other sensitive content before distribution.

Administrative and audit safeguards

Material administrative and workflow actions may be recorded to support accountability, troubleshooting, and investigation.

Depending on the function, recorded information may include:

• The user who performed an action.
• The affected account, employee, request, or asset.
• The date and time of the action.
• Previous and updated values.
• Approval or decision history.
• Allocation, return, or handover progress.
• Workflow status changes.
• Relevant administrative or security events.

Audit and workflow history must not be altered, deleted, or used to conceal activity. Access to logs and history should be limited to authorised users with a legitimate operational, administrative, investigative, or compliance-related requirement.

Audit information supports investigation but does not by itself prove a person's intention or establish wrongdoing. Events must be assessed with the available technical and business context.

Secure administration

Administrators must use their privileged access only for authorised operational purposes.

• Use an individual named account rather than sharing credentials.
• Complete required authentication and MFA verification.
• Apply the minimum permissions necessary.
• Confirm the correct user or record before making changes.
• Avoid changing roles, permissions, or account status without appropriate authority.
• Review the impact before disabling accounts or modifying workflow access.
• Protect temporary passwords and never send them through insecure channels.
• Preserve relevant records when investigating an incident.
• Report unexpected privilege, access, or configuration behaviour.
• Sign out of administrative sessions when work is complete.

Administrative access does not permit browsing employee, asset, or workflow information without a legitimate business requirement.

Data minimisation and safe handling

Only the minimum information reasonably required to complete an approved Chloé workflow should be submitted.

Before entering or attaching information, users should confirm:

• The correct employee, manager, company, department, and location have been selected.
• The information is relevant to the workflow.
• The intended recipients and authorised viewers are appropriate.
• Free-text notes do not contain credentials or unnecessary personal information.
• Screenshots and attachments have been checked for unrelated or confidential content.
• Asset identifiers and service tags relate to the correct equipment.
• Information copied from email or another system does not contain hidden sensitive data.

Information obtained through Chloé must not be copied into personal email, unauthorised cloud storage, consumer messaging platforms, removable media, or unapproved systems.

User responsibilities

• Use a strong, unique password that is not used for another service.
• Keep passwords, MFA codes, recovery codes, and reset links private.
• Never approve an MFA prompt they did not initiate.
• Lock their device whenever it is unattended.
• Sign out from shared, temporary, or remotely accessed devices.
• Use approved business devices, networks, and support channels where required.
• Keep supported devices and browsers updated.
• Check recipients, employee details, request information, and attachments before submission.
• Report lost or stolen devices promptly.
• Report suspicious sign-ins, phishing, unexpected password resets, or unexplained account changes.
• Report access that appears broader than their authorised responsibilities.
• Avoid downloading, copying, or retaining information unless required for an approved business purpose.
• Never attempt to bypass role restrictions, approvals, validation, or workflow controls.

Users who unexpectedly gain access to information outside their responsibilities must stop viewing it and report the issue. They must not continue browsing to determine how much information is accessible.

Events that should be reported

A suspected security issue should be reported when it involves or may involve:

• Access to another user's information without an approved business reason.
• An authentication, MFA, password reset, or session-control bypass.
• Unexpected administrator or elevated permissions.
• Information being displayed to an incorrect role or account.
• A user remaining signed in after an expected sign-out or account disablement.
• A password, token, recovery code, secret, or configuration file being exposed.
• Unauthorised modification or deletion of a request, asset, account, or workflow record.
• Suspicious sign-in activity or unexplained account changes.
• Phishing or impersonation using the Chloé name, branding, or email identity.
• Malware, malicious links, or unsafe attachments associated with the platform.
• A lost or stolen device that has an active Chloé session.
• Security headers, HTTPS, or browser protections appearing to be absent or bypassed.
• Sensitive information appearing in an error message, URL, log, export, or screenshot.
• Repeated application errors that may expose information or affect access controls.

Ordinary support requests, access applications, cosmetic defects, and general feature requests should use the normal Chloé contact or IT support process unless they also present a security risk.

Responsible disclosure

This page is not authorisation to test, scan, probe, exploit, or disrupt Chloé.

If a possible weakness is encountered during normal authorised use:

1. Stop testing after confirming the minimum information necessary to describe the concern.
2. Do not access additional accounts, records, employees, requests, assets, or information.
3. Do not modify, delete, download, copy, or publish affected information.
4. Preserve only the minimum evidence necessary.
5. Report the concern privately through the approved security contact.
6. Allow reasonable time for investigation and corrective action.
7. Do not disclose the issue publicly without prior written agreement.

Without prior written authorisation, do not:

• Perform automated vulnerability scanning.
• Attempt password guessing, credential stuffing, or MFA-code guessing.
• Test accounts that do not belong to you.
• Use social engineering, phishing, impersonation, or deception.
• Upload malware or intentionally unsafe content.
• Attempt denial-of-service or resource-exhaustion testing.
• Circumvent authentication, permissions, rate limits, or workflow controls.
• Establish persistent access.
• Access information beyond the minimum required to identify an accidental exposure.
• Change or delete production information.
• Interfere with normal platform availability or other users.
• Contact employees, customers, service providers, or other third parties about the issue.

Security research, penetration testing, or automated assessment requires prior written authorisation defining the approved scope, method, timing, test accounts, contacts, and handling of evidence.

Submission of a report does not create a contractual relationship or guarantee payment, a reward, public recognition, or a fixed response or remediation time unless this has been agreed in writing.

If you suspect account compromise

• Stop using the affected Chloé session.
• Contact IT Support through an approved channel.
• From a trusted device, change the password through the approved reset process where it is safe to do so.
• Do not use a device suspected of malware or credential theft to change the password.
• Do not approve any unexpected MFA request.
• Ask IT Support to review the account and terminate affected sessions where necessary.
• Preserve relevant emails, notifications, timestamps, and error messages.
• Do not delete messages, browser history, logs, or other evidence that may assist investigation.
• Provide the approximate time, device, browser, location, and activity observed.
• Do not send credentials or authentication codes as evidence.

IT Support may temporarily disable an account, terminate active sessions, reset authentication information, restrict access, or preserve relevant records while the issue is assessed.

Lost or stolen devices

A lost or stolen device that may have access to Chloé must be reported immediately. Provide:

• The user's name and account email.
• The device type.
• The approximate date and time the device was lost or stolen.
• Whether the device was signed in to Chloé and whether it was locked.
• The last known location, where appropriate.
• The asset or service tag, where known.

Do not attempt to recover a stolen device personally where doing so could create a safety risk. Follow the approved company and law-enforcement reporting processes where applicable.

Security review and continuous improvement

Chloé's security safeguards are reviewed as the platform develops. Changes affecting authentication, sessions, permissions, administrative access, user onboarding, user offboarding, asset visibility, workflow history, exports, or sensitive data handling should be assessed and tested before release.

Security improvements may be introduced in stages. A feature should not be described as active until it has been implemented, tested, deployed, and verified in the live environment.

Security controls reduce risk but do not replace responsible administration, access reviews, secure endpoint management, patching, protected backups, monitoring, incident response, or user awareness.

Privacy and confidentiality

A security report may itself contain confidential or personal information. Reports must be shared only with authorised personnel involved in assessment and response.

Chloé may retain relevant report information, technical evidence, audit events, and related correspondence where necessary to investigate, remediate, document, or prevent a security issue.

Investigation details, internal logs, affected-user information, infrastructure information, and remediation methods may be restricted and may not be disclosed to the reporter or publicly.

Contact

For security concerns, email chloe-ops@futureintelligence.online.

For ordinary support, account access, or general enquiries, use the approved Chloé contact or IT support process.