Security policy

CampUs TECHNOLOGIES C.A. protects this website and the rest of its systems, and monitors the activity they receive. This policy explains what is not allowed, what counts as authorization and how to tell us if you notice a problem. It applies to anyone, from any country.

Scope

This policy covers campus-tec.com and all its subdomains, our products and services, the infrastructure behind them and the people who work with us.

No testing without authorization

We do not allow security testing of any kind against the systems in scope without the company’s prior written authorization. Among other things, the following are not allowed:

• reconnaissance, that is, gathering technical information about our systems to prepare a test or an attack;
• port, service or vulnerability scans, automated or manual;
• attempts to access without permission, exploit a flaw or bypass a control;
• load or denial-of-service tests;
• automated submission of forms or requests, and automated extraction of content;
• introducing malicious software;
• reverse engineering, decompiling or analyzing the code of our products, except as their license expressly allows;
• social engineering or phishing aimed at our team;
• physical access, or attempted access, to our premises.

This page grants no authorization.

What counts as authorization

An authorization is valid only if it is set out in a document signed by a legal representative of CampUs TECHNOLOGIES C.A. stating who runs the tests, on which systems, on which dates and under what conditions. It covers only what that document says.

An email, a message, a conversation or anyone else’s permission is not an authorization. Neither is a customer’s or a supplier’s contract, unless it says so expressly. Nothing we authorize extends to third-party systems, such as those of our customers or suppliers.

If you need to assess our systems or products, write to security@campus-tec.com before you start and we will agree on the document.

Legal framework

Accessing a system without authorization, damaging it, interfering with how it works or obtaining information from it are crimes in Venezuela under the Special Law against Computer Crimes (Ley Especial contra los Delitos Informáticos), among others in its articles 6 (unauthorized access), 7 (sabotage or damage to systems) and 11 (computer espionage). They are also crimes in most countries, and anyone acting from abroad is also answerable under the laws of their own country.

When faced with unauthorized activity we may block it, log it and preserve the evidence, report it to the competent authorities in Venezuela or in other countries, and take the civil and criminal action that applies.

If you notice a security problem

If, without looking for it, you see something that looks like a security flaw in our website or our products, tell us at security@campus-tec.com. Do not keep investigating or try to confirm it: telling us what you saw is enough.

In your message, tell us what you saw, where (the address or the product) and when. If it includes sensitive information, encrypt it with our PGP key. You can write in Spanish or in English.

We confirm that we received your message within 3 business days.

Finding or reporting a flaw does not give you the right to exploit it, to access information, or to keep or share it. We do not run a bug bounty program unless we announce one officially in writing, and a report does not entitle you to any payment.

Information you come across by accident

If you happen to see data of ours or of third parties, do not copy it, keep it or share it with anyone. Delete whatever you have and tell us in your message.

Confidentiality

Do not publish or share details of a possible flaw, or of what you reported to us, without our written consent.

Governing law

This policy is governed by the laws of the Bolivarian Republic of Venezuela and any dispute is submitted to its competent courts, without prejudice to any action that applies in other countries. If the Spanish and English versions differ, the Spanish version prevails.

Changes

We may change this policy at any time. The version in force is the one published on this page, with its update date.

PGP key and security.txt

• PGP key of the security mailbox. Fingerprint: 1624 CC55 D783 BF4D F966 19E0 488C E324 FB8F 5889.
• Our security.txt follows RFC 9116.