Security
Report a vulnerability
Floom holds portfolio data for private markets funds. If you have found a weakness in our systems, we want to hear about it, and we will not take action against you for telling us.
Report an issueHow it works
How to report
Enough detail to reproduce it: the page, the steps you took, what you saw.
Safe harbour
Act in good faith under our guidance and we won't pursue legal action or report you.
What's in scope
Cross-customer data access, auth bypass, exposed keys, remote code execution.
Compliance
Our SOC 2 Type I report: independently examined, no exceptions noted.
Compliance
Our SOC 2 report
Floom's security controls are independently examined against SOC 2 standards, with no exceptions noted.
- Report
- SOC 2 Type I
- Issued
- As of 9 September 2026
- Criteria
- Security
- Examined by
- An independent licensed CPA firm
- Result
- 60 controls, no exceptions noted
Our commitments
The timelines we hold ourselves to
From the day your report arrives. We keep you updated until it is resolved, and tell you when the fix ships.
Read the full policyPrefer to write? The security address reaches the team directly.
Guidance for researchers
Email us at security@floom.vc with enough detail to reproduce the issue: the affected endpoint or page, the steps you took, and what you observed. Screenshots or a short recording help.
If you act in good faith under the guidance below, we will not pursue legal action, and we will not report you. Tell us before disclosing publicly and give us reasonable time to fix it.
- Test only against accounts you own or have permission to use.
- Stop as soon as you have confirmed a vulnerability exists.
- Give us reasonable time to fix an issue before disclosing it.
- Access, modify, download or retain data belonging to anyone else.
- Run automated scanning that degrades service for our customers.
- Attempt denial of service.
- Use social engineering or physical attacks against our staff or providers.
- Hold a finding for payment.
What we are most interested in
- Anything that lets one customer reach another customer’s data.
- Any path to authentication bypass or privilege escalation.
- Exposure of credentials or API keys.
- Remote code execution.
- Anything that would let portfolio data leave our systems.
Out of scope
- Findings from automated scanners without a demonstrated impact.
- Missing security headers with no exploitable consequence.
- Rate limiting on non-authentication endpoints.
- Reports about software versions alone.
- Issues on third-party services we do not operate. Report those to the provider.
Disclosure
We acknowledge reports within 2 business days and tell you our assessment of severity within 5 business days. We will keep you updated until it is resolved, and we will tell you when the fix ships.
We aim to remediate critical issues within 7 days and high-severity issues within 30 days of confirming them. We are happy to credit you once a fix has shipped, if you would like that.
Looking for our compliance posture rather than a place to report a bug? Our Trust Center covers SOC 2 status, the controls we operate, where your data is held, and the documents we share on request.
This policy is also published in machine-readable form at /.well-known/security.txt. If you cannot reach the security address, support@floom.vc also reaches us.