Last updated: November 2, 2026.

If you think you have found a security vulnerability in Atriomail, please tell us. Email security@atriomail.com with "Security" in the subject line. We welcome reports from anyone, whether or not you are a customer.

What to include

  • What the issue is, and what an attacker could do with it.
  • The page, API endpoint or hostname it affects.
  • Steps to reproduce it, with a proof of concept if you have one.
  • The email address of the test account you used.
  • Whether you would like public credit, and under what name.

Please do not put real customer data, passwords or API keys in your email. If you need to share something sensitive, tell us and we will agree a safer way to send it.

What is in scope

  • atriomail.com and its subdomains, including the control panel and API at system.atriomail.com.
  • The mail, webmail and live chat services that run on those subdomains.
  • The modules and integrations we publish for billing and automation tools.

What is not in scope

  • Customer domains and white-label hosts. These belong to our customers, so please do not test them. A bug in the platform behind them is in scope, and you can show it from your own account.
  • Third-party services we use. Please report those to the vendor.
  • Findings with no demonstrated security impact, such as missing security headers, SPF, DKIM or DMARC settings, software version banners, clickjacking on pages with no sensitive action, self-XSS, or unreviewed scanner output.
  • Spam or phishing sent by one of our customers. That is an abuse report, so please see our Acceptable Use Policy.
  • Help with your own account. Please use the live chat in the control panel.

Rules for testing

  • Test only on an account you created yourself. You can sign up here.
  • Only access data that belongs to you. If you reach anyone else's data, stop, do not copy or keep it, and tell us what you saw.
  • Do not change or delete anything you do not own, and do not leave a backdoor or anything else behind.
  • No denial of service, load testing, password guessing or high-volume automated scanning.
  • Send mail only to addresses you own. No spam and no phishing.
  • Do not try to trick our staff or customers, and do not contact our customers about what you find.
  • Keep the details private until the issue is fixed. If you plan to publish, we will agree a date with you.

What you can expect from us

  • We will reply to confirm we have your report.
  • We will tell you whether we could reproduce it, and let you know when it is fixed.
  • If you would like public credit, tell us and we will agree how.
  • We do not run a paid bug bounty, so we do not pay for reports.

Good-faith research

If you act in good faith and follow the rules on this page, we consider your testing authorized. We will not treat it as a breach of our Terms of Use or Acceptable Use Policy, and we will not take legal action against you or report you to law enforcement because of it. We can only speak for AtrioSolutions LLC, so this does not bind our customers or suppliers. If you are unsure whether something is allowed, ask us before you try it.

The machine-readable version of these contact details is at /.well-known/security.txt.