Skip to main content
dekla.
nav.aiImpostazioniInformazioni

Security + bug bounty

Responsible disclosure

We welcome security reports. Encrypted communication via PGP — see the key on GitHub. Email: [email protected]

Safe harbor

dekla will not file a criminal complaint against security researchers who stay within the published scope and report findings responsibly. For third-party systems (for example hosting providers) we cannot make any commitment.

Rewards (in CHF)

  • Critical: CHF 3'000
  • High: CHF 1'000
  • Medium: CHF 300
  • Low: acknowledgement + swag

Scope

Production at dekla.ch. Out of scope: DoS, social engineering, tests against other users.

Keeping supporting documents (Art. 126 DBG)

Keep your supporting documents for as long as the tax authority can ask for them (up to ten years in additional-tax proceedings). Self-employed persons and legal entities must keep their accounting records and documents for ten years under Art. 126 para. 3 DBG. dekla stores your data only on your device — you are responsible for regular vault exports and their safe keeping. If a device is lost without a backup, the data is irretrievable.