Reporting a security problem
Vyom HRM holds payroll and identity data for other people's employees. If you have found something wrong with it, we would rather hear from you than not.
Tell us what you found, where, and enough to reproduce it. If you would like a reply in a particular language, say so — we answer in English by default.
What we will do
- Acknowledge your report within three working days.
- Tell you within ten working days whether we have reproduced it, and what we intend to do.
- Keep you informed while we fix it, and tell you when it is deployed.
- Credit you by name when we publish the fix, unless you would rather we did not.
What we ask
- Give us reasonable time to fix it before telling anybody else.
- Use only accounts you own or have been given for testing. Do not read, change, or keep anybody else's data — this is a payroll system, and the records in it belong to real people who did not consent to being part of a test.
- Do not degrade the service: no denial of service, no load testing, no spam or phishing of our staff or customers.
- Stop as soon as you have demonstrated the problem. Proving access is enough; using it is not.
In scope
vyomhrm.comand its subdomains, including customer workspaces you have been given access toapi.vyomhrm.comandportal.vyomhrm.com- The mobile applications published under our name
Out of scope
- Findings from automated scanners with no demonstrated impact
- Missing headers or cookie flags with no exploitable consequence
- Rate limiting on endpoints where the limit is deliberate and documented
- Social engineering of our staff or our customers'
- Anything requiring physical access to a device somebody is already signed in on
Safe harbour
If you follow this policy in good faith, we will not pursue or support legal action against you for your research, and we will say so if anybody asks us to. If a third party takes action against you for work that stayed within this policy, tell us and we will make that clear to them.
We cannot waive the rights of our customers, whose data sits in these systems. That is why the request above is specific: stop at proving the problem.
We do not pay bounties
Not yet, and we would rather say so than let you find out after the work. We answer, we fix, and we credit.
Machine-readable version: /.well-known/security.txt. Last reviewed 23 September 2026.