Information security is part of Blackbone's development and operations. ISO/IEC 27001, OWASP and NIST guidance inform the security framework; a reference to a framework is not a certification claim. Specific controls and service levels are defined for each service.
1. Security framework
Security work covers asset inventories, information classification, risk assessment, secure development, code review, dependency management, access control, backup and recovery. The measures selected depend on the system, sensitivity and agreed requirements.
2. Technical and organisational measures
Core principles include encrypted transport, appropriate protection of stored data, least-privilege access, protected administrative authentication, separation of environments, logging, vulnerability remediation and tested recovery procedures. Personnel and collaborators must protect confidential information and handle access and devices responsibly. Project documentation identifies the controls actually applicable to that project.
3. Regulatory requirements
We assess relevant cybersecurity obligations for the service, including NIS2 where applicable. In Romania, the NIS2 framework includes Emergency Ordinance 155/2024, as amended. Incident reporting duties depend on the entity, incident and applicable law. DNSC provides the national guidance and reporting channels.
4. Report a vulnerability
Email security@blackbone.ro with the subject [Vulnerability Disclosure] and a short summary. Include the affected address or application, reproduction steps, likely impact and a minimal proof of concept. Do not send other people's personal data or secrets; contact us first if an encrypted channel is needed.
5. Scope and boundaries
Reports may concern Blackbone-owned websites, public APIs and applications. Do not perform denial-of-service attacks, spam, social engineering, physical attacks or testing against third-party systems. Do not access, change or retain data belonging to others. Stop testing if it risks disruption and report the finding privately.
6. Coordinated disclosure
We welcome good-faith reports within these boundaries and ask for a reasonable remediation period, normally up to 90 days, before public disclosure. The published Blackbone programme provides for an acknowledgement within two working days and initial triage within five working days. Remediation timing depends on severity, impact and the affected service; we keep the reporter informed. Testing outside the stated boundaries is not authorised.
7. Incidents and contact
Incidents are assessed, contained and investigated. Required notices to customers, affected people, ANSPDCP or DNSC follow the applicable law and contract. Security questions and reports: security@blackbone.ro.