1. Due Diligence Package

1.1. Learn about the cybersecurity measures our company has taken by visiting the due diligence package page https://www.greenparrot.io/trust-center/due-diligence-package.

2. Security FAQs

2.1. Review answers to the most frequent asked questions in our security FAQs page https://www.greenparrot.io/trust-center/faqs.

3. Security Resources

3.1. See what are the most requested security information to help you understand our security posture on the security resources page https://www.greenparrot.io/trust-center/resources.

4. Cloud status

4.1. Find status updates about significant incidents or scheduled maintenance of our Cloud services as well as a record of past incidents and maintenance.

4.1.1. Desktop Cloud Status https://status.greenparrot.io/platform

4.1.2. Consumer Scan Status https://status.greenparrot.io/scan

4.1.3. API Data Status https://status.greenparrot.io/api

4.1.4. Regional/Country Status https://status.greenparrot.io/regions

5. Customer penetration testing

5.1. Many organizations are required to validate that their computing environments meet corporate standards for security. Customers are able to run penetration testing (pen testing) against their environment but need to work with our team to ensure that they are not impacting any other customer. This section provides information on the requirements and how to coordinate the testing.

5.2. The person submitting this notification agrees that (1) any penetration testing will comply with the Customer Penetration Test requirements; and (2) they have authority to agree to these terms on behalf of the Customer.

5.3. Submit your pen test notification by emailing secure@greenparrot.io.

6. Customer pen test requirements

6.1. This document describes the requirements (“Requirements”) for customers (“you”) to perform penetration tests against your Cloud services environments. These Requirements are designed to allow you to evaluate the security of your Cloud environment(s) while preventing harm to other customers or to our company, including associated infrastructure, computing environments and data.

6.2. All penetration tests must follow the Requirements. Use of our Cloud services will continue to be subject to the terms of the agreement and terms under which you purchased the relevant service. Any violation of these Requirements or of the relevant service terms may result in suspension or termination of your services and legal action as set forth in your agreement. You are responsible for any damage to our Cloud infrastructure (including networks, machines and data) and to any other customers caused by failure to abide by these Requirements or your services agreement.

7. Prior notice

7.1. To avoid false security alerts and to prevent interruption of your penetration test, you must notify us by emailing secure@greenparrot.io at least 24 hours prior to the start of any penetration test.

8. General conditions

8.1. You may perform penetration testing only of your subdomain(s) identified on the Penetration Test Notification Form.

8.2. You may not attempt to scan, test or impact any other domain or environment or to access any domain, environment or data that is not yours.

8.3. You may not perform a denial of service attack, fuzzing or other activity designed to interrupt availability of the service or to access or affect the integrity of data on any computing environment.

8.4. You may not attempt phishing or other social engineering attacks or insertion of malware or other malicious code into the service.

8.5. You may not attempt to exploit any vulnerabilities found during testing (e.g., data exfiltration), and activities that could pose risk to our company’s infrastructure, data or other customers must be discontinued once a vulnerability is found.

8.6. Green Parrot Collective Pty Ltd is not responsible for any impact to your computing environment or service levels related to your penetration testing activities.

8.7. Green Parrot Collective Pty Ltd reserves the right to respond to any actions on its networks that appear to be malicious and to discontinue or require you to discontinue a penetration test at any time.

9. Reporting

9.1. If you believe you discovered a potential security flaw, you must report it to our company within 24 hours. You may not disclose vulnerability information publicly or to any third party until you hear back from our company that the vulnerability has been fixed.