Vulnerability Disclosure Policy.
How to report a security vulnerability in HIPS's systems and software, what is in scope, the rules for research, and HIPS's commitment not to act against good-faith research.
- Version
- 1.0
- Last updated
- In effect from
- 2026-10-27
- Length
- 7 sections
- Questions
- security@hips.comSection 7
HIPS Payment Group Limited (HIPS, we, us or our) welcomes reports of security vulnerabilities in its systems and software. This Vulnerability Disclosure Policy (the Policy) says what you may test, how, and how to report what you find. Research that follows it in good faith is authorized, and HIPS will not act against you for it (Section 6).
The Policy in brief
- Report to security@hips.com, with what HIPS needs to reproduce the issue (Section 4).
- Stay in scope: only systems HIPS controls, never a Provider's Device, an Approved Provider's infrastructure, a host of HIPS Payments or any other third party (Section 2).
- Do no harm: your own accounts only, no denial of service, no social engineering, no keeping or sharing data (Section 3).
- Coordinate: keep the issue confidential until it is fixed, and in any case for ninety (90) days after your report (Section 5).
- Safe harbor: HIPS will not bring a claim or ask an authority to act against good-faith research that follows this Policy. HIPS pays no reward (Section 6).
01About this Policy
Who is responsible. HIPS Payment Group Limited (registered name HIPS PAYMENT GROUP LIMITED), trading as HIPS, is a company incorporated in Ireland and registered with the Companies Registration Office under number 639131, with its registered office at 5 The Courtyard Building, Carmanhall Road, Sandyford, Dublin 18, Ireland. Hyperscale Inference Processing Systems OÜ, of Estonia, operates HIPS's systems for HIPS and handles reports for it.
How it relates to HIPS's other documents. For a person who uses the Services, the Acceptable Use Policy (Section 10) prohibits security testing except as HIPS authorizes it. Research that follows this Policy is Security Research that HIPS authorizes under Acceptable Use Policy Section 10.3. Any other research needs HIPS's prior written authorization.
02Scope
In scope. Systems and software that HIPS controls:
- (a)the HIPS website at hips.com;
- (b)the Console at console.hips.com;
- (c)the API at ai.hips.com and its regional addresses eu.ai.hips.com, us.ai.hips.com and jp.ai.hips.com;
- (d)providers.hips.com, the service the Provider App connects to; and
- (e)the Provider App, the `hi` command-line tool, the HIPS SDKs and any other tool that HIPS supplies.
Out of scope. This Policy does not authorize testing of, and you shall not test:
- (a)a Provider's Device or any other computer that is not yours;
- (b)the infrastructure of an Approved Provider, such as RunPod;
- (c)any host under hips.com that is not listed in Section 2.1, including every host that HIPS Payments uses, and https://hipspay.com;
- (d)the systems of HIPS's payment provider, identity verification provider, model hubs or any other third party; and
- (e)any Account, Workspace, Device or data that is not yours.
03The rules for research
When you research under this Policy, you shall:
- (a)test only the systems of Section 2.1;
- (b)use only Accounts and Workspaces that you own, reach no data of others beyond the minimum needed to show a vulnerability, and stop at once and tell HIPS if you reach any;
- (c)not degrade the Services for others, including by denial-of-service or high-volume automated testing;
- (d)not use social engineering, phishing or physical access;
- (e)not keep, copy or disclose data you reach, and delete it when HIPS asks or the testing ends;
- (f)report every vulnerability you find to HIPS promptly, with what HIPS needs to reproduce it; and
- (g)keep each vulnerability confidential as Section 5 provides.
Measuring the latency, throughput and cost of your own Requests within your limits, load testing your own application within the limits of your Plan, and evaluating a model's behavior through ordinary Requests are not security research, and the Acceptable Use Policy applies to them as to any other use.
04How to report
Where. Report to security@hips.com, the address that HIPS also publishes at /.well-known/security.txt on hips.com.
What to include. Please include the system or software concerned and its version, a description of the vulnerability and its impact, the steps to reproduce it, any proof of concept, and how HIPS can reach you. Do not include data of others; if you reached any, say so instead of sending it.
Credentials you find. If you come across an API Key, a Tool Token, a Hub Token or another credential for the Services that is not yours, do not use it, and report it to security@hips.com.
05What HIPS does, and coordinated disclosure
HIPS's handling. HIPS acknowledges each report without undue delay, triages and tracks it, may ask you for more information, and tells you when the vulnerability is fixed.
Confidentiality. Keep each vulnerability confidential until HIPS has fixed it or agrees to its disclosure, and in any case until ninety (90) days after you reported it, or, if HIPS releases a fix within those ninety (90) days, until thirty (30) days after the fix is released, unless you and HIPS agree a longer or shorter period in writing.
Security updates for the Provider App. HIPS handles vulnerabilities in the Provider App under this Policy, provides security updates free of charge, and tells Providers of an actively exploited vulnerability or a severe incident affecting the Provider App, with the measures they can take, as Article 14(8) of Regulation (EU) 2024/2847 requires (Provider Agreement Section 5.15).
06Authorization and safe harbor
Authorized research. Research that follows this Policy in good faith is authorized by HIPS. HIPS will not bring a claim against you, or ask any authority to act against you, for such research. If a third party brings a claim against you for research that followed this Policy, HIPS will make it known that your research was authorized.
Its limits. The authorization covers only systems HIPS controls (Section 2.1), and never a Provider's Device, an Approved Provider's infrastructure, a host of HIPS Payments or any other third party's systems, which HIPS cannot authorize. It does not cover research that breaks the rules of Section 3, or that is not in good faith, such as extortion or a demand for payment.
No reward. HIPS pays no reward for a report.
07Changes and contact
This version. This is version 1.0 of the Policy, dated 27 October 2026 and in force from that date. HIPS may change it by publishing a new version at hips.com/security; research already under way when a change is published may continue under the version in force when it started.
Contact.
- Vulnerability reports
- security@hips.com
- Machine-readable contact
- https://hips.com/.well-known/security.txt
- Postal address
- HIPS Payment Group Limited, 5 The Courtyard Building, Carmanhall Road, Sandyford, Dublin 18, Ireland