Security & Vulnerability Disclosure

Friis of Sweden AB — ACRMI (https://acrmi.se) · Effective 2026-07-01

We are committed to keeping ACRMI and its users' data secure. If you believe you have found a security vulnerability, we welcome your report and will work with you to resolve it.

Reporting a vulnerability

Email security@acrmi.se. We acknowledge receipt within three business days and keep you updated through remediation. Reports may be submitted anonymously.

Please include: a description of the issue, where it was discovered (URL/component), potential impact, and steps to reproduce (scripts/screenshots welcome). English is preferred.

Guidelines

• Notify us as soon as possible after discovering a real or potential issue.
• Give us reasonable time to resolve it before any public disclosure.
• Avoid privacy violations, service degradation, and destruction or manipulation of data.
• Use an exploit only to the minimum extent needed to confirm the vulnerability — do not access or exfiltrate data, establish persistence, or pivot to other systems.
• Stop and notify us immediately if you encounter sensitive data, and keep it confidential.

Scope

In scope: the ACRMI web application (https://acrmi.se), its Supabase-hosted backend and edge functions, and the ACRMI desktop application. Third-party services ACRMI integrates with (Google, Microsoft, Supabase, Vercel, Telnyx, Stripe) are out of scope and should be reported to those vendors directly. If unsure, email us first.

Not authorised

• Denial-of-service (DoS/DDoS) testing.
• Physical testing, social engineering (phishing, vishing), or other non-technical testing.

Our commitment

Security research conducted in good faith and in accordance with this policy is authorised; we will not pursue legal action for such research. If you share contact details, we will communicate transparently and keep you informed through confirmation and remediation.