Security & Responsible Disclosure

Last updated: 8 May 2026 · Operated by LINK E2E LLC

Security is foundational to Trust. This page describes the technical safeguards we apply to the website and the process for reporting a security issue to us.

Our security posture

Trust follows OWASP best-practice guidance for public-facing web applications:

• HTTPS-only — enforced via HSTS with a 2-year max-age, includeSubDomains, and preload eligibility.
• Strict CSP — first-party scripts and styles only, plus narrowly allowlisted Google Fonts; no third-party advertising or analytics.
• Clickjacking protection — X-Frame-Options: DENY plus CSP frame-ancestors 'none'.
• MIME-sniff blocking — X-Content-Type-Options: nosniff.
• Permissions hardening — camera, microphone, geolocation, payment, and USB APIs denied by default via Permissions-Policy.
• Cross-origin isolation — Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin against Spectre-class attacks.
• Email authentication — outbound mail from trustee.company is signed with DKIM and aligned via SPF and DMARC, in line with the 2024 Gmail / Yahoo / Microsoft sender requirements.
• No third-party trackers — no Google Analytics, no behavioural tracking, no fingerprinting.
• No PII in client storage — localStorage is used only for the user's theme and language preferences.

Production roadmap

Before any production payment processing, the Trust platform will operate under SOC 2 Type II controls and applicable payment-services licences in each jurisdiction we serve, including, where relevant, Hong Kong's SVF and MSO regimes, the United States MSB framework, the European EMI framework, and the United Arab Emirates VARA regime.

Responsible disclosure

What's in scope

• trustee.company and any subdomain we operate (currently the apex only).
• Email addresses on the trustee.company domain.

What's out of scope

• Findings that require physical access to a user's device or social engineering of staff.
• Denial-of-service attacks or volumetric load tests of any kind.
• Issues in third-party services we use (e.g., Netlify, Google Workspace) — please report those directly to the relevant provider.
• Reports based purely on missing best-practice headers without a demonstrated impact.
• Spam, phishing, or social-engineering attempts impersonating Trust that originate outside our infrastructure (please report these to security@trustee.company for tracking, but they fall outside our remediation scope).

What to include in your report

• A clear, concise description of the issue and where it was found (URL, parameter, request).
• Steps to reproduce, with sample requests or a proof-of-concept where possible.
• Impact assessment from your perspective.
• Your name or handle if you would like to be credited; otherwise we will treat the report as anonymous.

Our commitments

• We aim to acknowledge receipt within 48 hours (Hong Kong business days).
• We aim to provide an initial triage assessment within 5 business days.
• We will keep you reasonably informed of progress until the issue is resolved.
• We will publicly credit you, with your permission, once a fix is deployed.

Safe harbour

Provided that your testing is consistent with this policy, follows applicable law, and is limited to in-scope assets, LINK E2E LLC will:

• Consider your activity authorised under our terms of use, despite Section 4 (Acceptable use) of the Terms & Conditions.
• Not bring or support a private legal action against you in connection with that testing.
• Work with you in good faith to understand and resolve the issue quickly.

Safe harbour does not apply to testing that violates third-party rights, accesses or copies third-party data, or causes service degradation.

Contact

LINK E2E LLC — Security Team
155 Willowbrook Blvd, Ste 110, Wayne, New Jersey 07470, USA (Reg. No. 0451504330)
Email: security@trustee.company