Authorities, Notices & Security Research

This page is for three kinds of reader: authorities that need to reach us, anyone reporting illegal content or abuse, and security researchers. It sets out who to write to and what happens next.

1. Points of contact

Write to these addresses directly; you do not need an account, and messages are read by people, not filtered by an automated system.

2. Reporting illegal content

poolse is infrastructure: the conversations it carries belong to the apps our customers build. If you are a user of one of those apps, the quickest route is usually the app's own reporting tools or its operator. You can always report to us as well, at [email protected], with:

• where the content is: the app, and if you can, a conversation link, message time, or other identifier;
• why you believe it is illegal or breaches our Acceptable Use Policy;
• your name and email address, unless you are reporting child sexual abuse material, which you may report anonymously;
• a statement that you believe the report is accurate and complete.

What happens next:

1. We confirm receipt within two business days.
2. We assess the report, which can mean opening the specific content it points to. Message bodies are encrypted at rest, but our servers hold the keys, so we can do this. We look only at what the report concerns.
3. We tell the operator of the app concerned, who is usually best placed to act, and we act ourselves where the content is illegal or the operator does not: removing content, restricting a user, or suspending a workspace.
4. We tell you what we decided. Where we restrict content or an account, we give the affected customer a statement of the reasons and the facts we relied on, and how to contest it, unless a law or an authority forbids it.

Reports of child sexual abuse material are acted on immediately: we preserve what the law requires, remove access, and report to the competent authorities.

3. Requests from authorities

We respond to lawfully issued requests from competent authorities.

• Valid legal process. We require a request that is legally binding on Torsten Labs DOO, normally an order from a court or competent authority of North Macedonia. Authorities elsewhere should use the mutual legal assistance or other international channels that apply to a company established in North Macedonia.
• Minimum disclosure. We disclose only what the process compels, and we challenge requests that are overbroad, unclear, or improperly issued.
• Customer notice. The data we hold belongs to our customers' apps, so we tell the affected customer before disclosing, unless the law or the order forbids it. If it does, we tell them once that restriction ends.
• Emergencies. Where there is an imminent risk of death or serious physical harm, we may disclose the minimum information needed to prevent it, on a good-faith request from an authority, and record why.
• What exists. Message bodies are encrypted at rest, but our servers hold the keys, so stored content can be produced when valid process compels it. Call audio and video are never recorded, so they cannot be produced. What we hold is described in the Privacy Policy and the DPA.

Send requests to [email protected]. Every request we receive, and what we did about it, is recorded.

4. Security research

We welcome reports of vulnerabilities in poolse.dev, dashboard.poolse.dev, api.poolse.dev, and the @poolse/* packages.

Please:

• test only against a workspace you created yourself, on the free plan;
• stop and report as soon as you can show a vulnerability, and do not access, change, or keep data that is not yours;
• avoid anything that degrades the service for others: no denial-of-service, load testing, spam, or social engineering of our staff or customers;
• give us a reasonable time to fix the issue before you publish it, normally 90 days.

Send what you found, how to reproduce it, and its impact to [email protected]. We confirm receipt within two business days and keep you informed until it is fixed. We do not run a paid bounty programme, but we are glad to credit you.

Safe harbour. If you act in good faith and follow these rules, we will not take legal action against you or ask anyone else to, and we consider your research authorised. If in doubt about whether something is in scope, ask us first.

Our security.txt points here.