Security Vulnerability Disclosure Policy

Purpose

As a licensed paralegal firm, we owe our clients confidentiality, and our website and portals hold confidential client information. If you find a security weakness in our website or portals, please tell us so we can fix it before anyone is harmed. This policy sets out how to report it and the rules to follow.

How to report

Email info@neolegalservices.com with "Security" in the subject line. Please include:

• the page or address where the problem is;
• the steps to reproduce it;
• what you think someone could do with it.

Don't put anyone's personal information in your report: describe what kind of information could be reached instead. If you think someone has got into your own account, call us straight away.

What is covered

Our website at neolegalservices.com, and our client and staff portals.

What is not covered

• Services run by others, such as payment, phone, email, e-signature and hosting providers (see our Service Providers and Data Handling Policy). Please report those to the provider.
• Tricking or pressuring our staff or clients, by phishing, phone or impersonation.
• Physical attempts on our office or devices.
• Denial of service, or anything that slows or overloads our services.
• Spam, or filling in our forms in bulk.

Rules for testing

1. Use only your own account. Never try to sign in as someone else.
2. Leave other people's information alone. Never view, change, download, delete or keep it.
3. If you come across client information, stop. Go no further, don't share it, delete anything you saved, and tell us at once what kind of information you saw and where (not the information itself).
4. Show the problem, don't use it. Do only what is needed to show the weakness exists. Don't try to get past sign-in or access controls further than that, upload harmful files, or make payments with a card or account that isn't yours.
5. No automated scanning or testing that puts load on the site.
6. Give us reasonable time to fix a problem before telling anyone else.

What we do

• We aim to acknowledge your report within 5 business days, and to tell you the outcome where we can. Our duty of confidentiality to clients may limit what we can share.
• We fix confirmed problems as soon as we reasonably can, without promising a set timeline.
• If personal information may have been exposed, we deal with it under our Information Security and Data Breach Response Policy: we assess it, record it, and notify the people affected and the Office of the Privacy Commissioner of Canada where the law requires. A report about exposed personal information cannot be kept between you and us alone.

We handle your contact details under our Privacy Policy, and share details of a report only as needed to fix the problem (including with the service provider concerned) or to meet a legal, regulatory or professional duty.

Good faith

If you report in good faith and follow these rules, we will treat your report as help, not as a complaint against you. This is not a promise of immunity: we may still have to record, report or act on what happened where the law or our professional duties require it. You test at your own risk and are responsible for following the law, and to the extent permitted by law we are not responsible for any loss you suffer from testing. This policy does not change our Terms of Service or Website Content and Intellectual Property Policy, does not permit anything unlawful, and cannot bind anyone else. We reserve all our rights where these rules are not followed.

No rewards

We don't run a paid bug bounty or offer rewards for reports. Sending a report does not make you our client or create any agreement between us.

Review

This policy is reviewed at least once a year, and whenever the Law Society's By-Laws or rules change. The principal approves every change.

Questions

Email info@neolegalservices.com, call 647-200-3526 or toll-free 888-519-2435, or write to us at Unit 236, 1099 Kingston Road, Pickering, Ontario L1V 1B5.