If you believe you have found a security issue in Aegis Intercept, please submit a report to security@aegisintercept.com. Include as much detail as possible:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any proof-of-concept code or screenshots (if applicable)
• Your contact information for follow-up

Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and address it. We aim to resolve critical vulnerabilities within 30 days.

The following are in scope for security reports:

• The Aegis Intercept web application at app.aegisintercept.com
• The REST API at app.aegisintercept.com/api/v1/
• Authentication and session management
• Data exposure or unauthorized access to risk intelligence data

Out of scope: denial-of-service attacks, social engineering, physical attacks, or issues with third-party services we integrate with.

Aegis Intercept data is stored and processed in the United States. Our infrastructure security measures include:

• All traffic encrypted in transit via TLS 1.2+; HTTP is redirected to HTTPS
• Database and object storage encrypted at rest (AES-256)
• Database in a private network, not reachable from the internet, with daily automated backups
• Network isolation with least-privilege firewall rules
• Cloud audit logging enabled across all regions
• Secrets held in a managed secrets service, never hardcoded

• Multi-factor authentication required on every account
• Signed, HTTP-only session cookies and role-based access control
• Rate limiting on sign-in, password reset, and data endpoints
• Content Security Policy, HSTS, and other security headers on every response
• SQL injection prevention via parameterized queries throughout
• Static analysis (SAST) security scanning on every code change
• Principle of least privilege for all service accounts and IAM roles

Risk intelligence data is sourced from 19 OSINT integrations pulling from public data sources including the UN, World Bank, USGS, NOAA, and other government datasets. No personally identifiable information (PII) is collected or stored as part of the data pipeline. User account data (email, name, subscription tier) is stored in our database and handled in accordance with our Privacy Policy.

In the event of a security incident, we will notify affected users within 72 hours of discovery, in compliance with applicable data protection regulations. Notifications will be sent to the email address on file and posted to our status page.

We thank the security research community for responsibly disclosing vulnerabilities. Researchers who report valid, previously unknown vulnerabilities may be acknowledged in our security advisories at our discretion.

Security reports: security@aegisintercept.com
General inquiries: contact@aegisintercept.com