Security policy

Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly by emailing security@s4ledger.com. Do not open a public issue.

Scope

This policy applies to the S4 Ledger platform, SDK, API endpoints, and all associated web properties.

Response Timeline

• Acknowledgment within 24 hours
• Initial assessment within 72 hours
• Resolution target: 30 days for critical issues

Data Handling

S4 Ledger processes UNCLASSIFIED and CUI data only. No ITAR-controlled or classified data should be submitted to the public platform. Classified environments require on-premises deployment.