Trust
Security
How we secure Tellwright products, and how to report a vulnerability.
Our practices
- Government environments are operated from the United States by U.S. persons who have passed background checks; many hold security clearances.
- Every engineer with production access uses a hardware security key, and every production access is logged and reviewed.
- Customer data is encrypted in transit and at rest, with keys managed per mission partner. Mission partners on Concord Government Cloud may hold their own keys.
- Independent penetration tests of every product at least once a year, and before every major release.
- Kerbside cameras use signed firmware, encrypted connections and per-device credentials.
Vulnerability disclosure
If you believe you have found a security vulnerability in a Tellwright product or website, please write to security@tellwrightsystems.com with enough detail for us to reproduce it. We will acknowledge your report within two business days and keep you informed. We will not pursue legal action against good-faith research that follows this policy: do not access more data than you need to demonstrate the issue, do not degrade our services, and give us reasonable time to fix the issue before disclosing it.
Out of scope: mission partners’ own systems, the physical security of Kerbside cameras, and social engineering of our staff.
This website
This website is served as static files. It sets no cookies and loads nothing from other websites. Its security contact is published at /.well-known/security.txt.