--- title: Security & Vulnerability Disclosure — Vexium AI LLC url: https://vexiumai.com/security lang: en description: Who is accountable for security at Vexium AI LLC, which systems are in scope, how to report a vulnerability, the response timeline, rules of engagement with safe harbor, and the security practices in place today. updated: 2026-10-09 --- # Security at Vexium AI Who is responsible for security at Vexium AI LLC, which systems that covers, and how to report a vulnerability to us. Machine-readable contact information is published at https://vexiumai.com/.well-known/security.txt (RFC 9116). Company: Vexium AI LLC, Kansas City, MO, United States. ## 1. Security leadership Security at Vexium AI LLC is led by **Cristian Ramirez, Founder & CEO**. He is accountable for the security of our products and infrastructure, owns the security program and is the company's security point of contact for customers, researchers and partners. - Security contact: security@vexiumai.com - Alternate: ram@vexiumai.com - LinkedIn: https://www.linkedin.com/in/cristianramirez3/ ## 2. Scope: systems we own and operate This policy covers the systems that Vexium AI LLC owns and operates: - **vexiumai.com**: this website and its public, read-only agent endpoints (MCP and A2A). - **Vexium CRM, crm.vexiumcore.com**: multi-tenant CRM for WhatsApp, Messenger and Instagram. - **Vexium Voice, vexiumvoice.app and its subdomains**: bilingual AI voice receptionist for phone and web. - **Agentes Vexium, bots.vexiumdata.com**: conversational agent platform and the messaging channels it operates. Systems we build and host for our clients are not in scope for independent testing. Test them only with that client's written authorization. If you find something in one of them, report it to us and we will coordinate with the client. ## 3. How to report a vulnerability Email the details to security@vexiumai.com. Include the affected system or URL, steps to reproduce or a proof of concept, the impact as you understand it, and how we can reach you. What to expect: 1. Acknowledgement within 2 business days. 2. Triage and first status within 5 business days: we reproduce the issue, assign a severity and tell you what we plan to do. 3. Remediation targets by severity: critical in 7 days, high in 30 days, medium and low in 90 days. 4. Closure: we tell you when the fix is live and credit you publicly if you want us to. We do not currently run a paid bug bounty program. We do say thank you, we fix what you find, and we credit you if you wish. ## 4. Rules of engagement and safe harbor Good-faith research means testing only with accounts and data you own or created for the test, stopping as soon as you confirm a vulnerability and reporting it promptly, and giving us reasonable time to fix the issue before any public disclosure (we aim for 90 days at most). Not allowed: denial of service, resource exhaustion or spam against any of our systems or phone numbers; social engineering of our staff, clients or their customers; accessing, modifying, deleting or downloading data that is not yours (if you encounter personal data, stop and report it); pivoting from our systems into third-party systems, including those of our clients and providers. Safe harbor: we consider research that follows this policy to be authorized, and we will not pursue or support legal action against you for it. If a third party initiates action against you for research that complied with this policy, we will make it known that you acted in accordance with it. ## 5. How we protect our systems This is what we do today. It is not a certification, and we keep it current as our program grows. - Periodic internal security audits of our own code, covering authentication, authorization, database row-level security, injection and secrets, with severity-ranked findings and tracked remediation. - Secrets kept out of source code, secret scanning before code is published, and third-party tokens stored encrypted. - Cloudflare with managed firewall rules and rate limiting in front of our CRM; signed webhooks and per-token rate limits on our messaging and voice endpoints; HTTPS and security headers everywhere. - Tenant isolation enforced in the database and reviewed in every audit, so one client's data stays separate from another's. - Dependency monitoring with prompt patching of the frameworks we run on. - A named owner for incidents, and customers notified without undue delay when their data is affected. ## 6. Recent security work - June and August 2026: two internal security audits of a car-rental reservation system we build and operate, covering authentication, Postgres row-level security, rate limiting and HTML injection in e-mails. Findings were ranked by severity, fixed, and the fixes verified against production. - September 2026: closed an unauthenticated integration API on a rental ERP we operate and hardened its login and session handling, validated with 53 regression tests. - October 2026: phase 1 security audit of Vexium CRM (cross-tenant isolation, SSRF, OAuth and webhook signatures) with fixes merged and dependency advisories brought to zero; audit of a public quoting API (rate limiting, formula injection, privacy notice). - Ongoing: adversarial testing of our chatbots (prompt injection and data exfiltration), secret scanning before code is published, and firewall rules against automated scanners on our public endpoints. ## 7. security.txt and updates Machine-readable contact information for this policy is published at https://vexiumai.com/.well-known/security.txt, following RFC 9116. This page is reviewed at least once a year. The security.txt file expires on October 1, 2027 and is renewed before then. Related: Privacy Policy (https://vexiumai.com/politica), Terms of Service (https://vexiumai.com/condiciones), Data Deletion (https://vexiumai.com/eliminacion-datos).