Version 1.0.0, in force since 2026-11-01.
This page describes how MIDDAG, LLC, a limited liability company registered in Delaware, United States, approaches the security of its products and services, and how to report a security vulnerability or incident.
Security measures
MIDDAG, LLC applies technical and organizational measures to protect the products and services and the data that customers entrust to it.
The security measures that MIDDAG, LLC commits to for personal data processed on behalf of Business customers are described in the Data Processing Addendum.
This page describes practices and does not add warranties or obligations beyond those in the Terms of Service and the Data Processing Addendum.
Shared responsibility
Security is shared between MIDDAG, LLC and its customers.
A customer is responsible for the security of its own devices, networks and systems, for the accounts and credentials of its users, and for the configuration of the products and services that is under its control.
A customer is responsible for the security of software that it installs and runs in its own environment, including keeping it updated with the updates that MIDDAG, LLC releases.
A customer notifies security@middag.io without delay of any unauthorized access to or use of its account.
Security incidents
MIDDAG, LLC notifies affected Business customers of a security incident involving their personal data as set out in the Data Processing Addendum.
MIDDAG, LLC may take emergency action, such as fixing, updating, limiting or suspending a product or service, when there is a security risk, under the Terms of Service.
Reporting a vulnerability
MIDDAG, LLC welcomes reports of security vulnerabilities in its products, services and websites.
Reports are sent to security@middag.io.
A report should describe the vulnerability, the affected product, service or address, the steps to reproduce it, and its potential impact.
A report should not include personal data or customer data beyond what is strictly needed to describe the vulnerability.
Rules for researchers
A researcher acts in good faith and avoids any harm to MIDDAG, LLC, its customers, their users and their data.
A researcher tests only accounts and data that belong to the researcher, or that the owner has authorized in writing.
A researcher stops testing and reports at once when the researcher reaches data that does not belong to the researcher, and does not keep, use or disclose that data.
A researcher does not use denial-of-service attacks, load testing, social engineering, phishing or physical attacks, and does not test systems of third parties.
A researcher does not degrade, interrupt or change the products, services or websites, or the data in them.
A researcher keeps the vulnerability confidential until MIDDAG, LLC has fixed it or has agreed in writing to its disclosure.
A researcher does not demand payment or any other benefit in exchange for a report or for not disclosing it.
These rules allow testing only within the limits above; they do not authorize any other access or testing, and do not waive any right of MIDDAG, LLC under the law.
What MIDDAG, LLC does with a report
MIDDAG, LLC acknowledges the receipt of a report, assesses it and decides the action to take.
MIDDAG, LLC may contact the researcher to ask for more information, and informs the researcher when the vulnerability is fixed.
MIDDAG, LLC does not offer payment or a bounty program for reports.
MIDDAG, LLC may credit the researcher publicly for a report, with the researcher’s consent.
Other security reports
Abuse of the products and services, such as spam, phishing or malware hosted on them, can be reported to security@middag.io.
Changes
This page changes under the rules for changes in the Terms of Service, and each change is announced on the Updates page.
Changelog
- 1.0.0 — 2026-11-01 — First version.