Get started
Home/Reporting Security Vulnerabilities

Reporting Security Vulnerabilities

How to tell us privately about a security issue in our websites, hosted systems or products.

Last updated: 21 October 2026

Innosync Private Limited ("Innosync", "EasOf", "We", "Us" or "Our") takes the security of its websites, the customer systems it hosts and its products seriously. If you believe you have found a security vulnerability, please tell us privately so that we can fix it before it becomes public. This page explains how to report it and what to expect. It is referred to in our Master Service Agreement.

How to report a vulnerability

Email support@innosync.in with the subject line "Security vulnerability". Customers can also raise a ticket at https://innosync.in/helpdesk. Please include:

  • the affected website, product, version or URL;
  • a description of the issue and its possible impact;
  • clear steps to reproduce it, with any proof-of-concept code, screenshots or requests;
  • how we can contact you for follow-up questions.

Please do not include personal data or customer data in your report beyond what is strictly needed to show the issue.

Scope

  • Our websites: innosync.in and easof.com, including the customer systems we host on subdomains of easof.com.
  • Our products and services, including the Construction App, Cut Pro, ETL Pro and POS Pro, and the customisations and integrations we build on ERPNext and the Frappe Framework.

If the issue is in ERPNext or the Frappe Framework themselves, please also report it to their maintainers, Frappe Technologies, through https://frappe.io/security, and let us know so that we can update the systems we look after.

Out of scope

  • Denial-of-service or load testing of any kind.
  • Social engineering, phishing or physical attacks against our staff, offices or customers.
  • Spam, or reports produced only by automated scanners without a demonstrated impact.
  • Missing security headers or best-practice settings that have no demonstrated security impact.
  • Issues in third-party services that we do not operate.

What we ask of you

  • Test only against accounts and data that belong to you.
  • Do not access, change, copy or delete other people's data. If you come across such data, stop and tell us.
  • Do not disrupt our services or our customers' systems.
  • Give us reasonable time to investigate and fix the issue before you disclose it to anyone else.

What you can expect from us

  • We will acknowledge your report and keep you informed while we investigate and fix it.
  • We will treat your report and your contact details as confidential.
  • If you wish, we will credit you once the issue has been fixed.

Good faith

We will not pursue legal action against anyone who researches and reports a vulnerability in good faith and in line with this page. This does not authorise any activity that is unlawful or that harms our customers.