Information Security Policy
Controller and platform operator: Imoti 98 EOOD
Company ID (EIK): 207210213
Address: Lyulin 8, 1324 Sofia, Bulgaria
Email: support@hackera.online
Website:
https://rewards.hackera.online/
1. Purpose and scope
This Information Security Policy sets out the main principles and organisational measures through which Imoti 98 EOOD ("Hackera", "we" or the "Company") aims to protect the information, systems and services related to the Hackera Rewards platform.
The policy applies, where relevant, to:
- user profiles and business accounts;
- business information and employee data;
- information about virtual cards and payment operations;
- integrations with external providers, including Stripe;
- API access, software components and administrative interfaces;
- technical logs, backups and other information processed in providing the services.
The aim is to reduce the risk of unauthorised access, loss, unlawful disclosure, alteration or destruction of information.
2. Core principles
Hackera aims to apply the following principles:
Confidentiality. Access to information is limited to people and systems that have a legitimate need for it.
Integrity. Appropriate measures aim to prevent and detect unauthorised changes to data.
Availability. Reasonable efforts are made to keep the services accessible and to recover from technical problems.
Data minimisation. Information should be limited to what is necessary for the relevant purpose.
Accountability. Access and actions in the systems may be logged and reviewed where this is technically possible and lawful.
3. Access control
Access to administrative panels, systems, customer data and technical resources should be granted according to the role and duties of the person concerned.
Depending on the specific system and its capabilities, measures may include:
- using individual user accounts;
- limiting administrative rights;
- using strong and unique passwords;
- multi factor authentication for systems that support it;
- removing access that is no longer needed;
- reviewing permissions when the team or systems change.
Users are responsible for protecting their access credentials and for promptly reporting any suspicion of a compromised account.
4. Data protection
Hackera applies, or aims to apply, appropriate technical and organisational measures to protect information in line with the nature of the services, the relevant risks and the available technical options.
Depending on the infrastructure and services used, measures may include:
- encrypted connections between users and the supported services;
- restricted access to databases and administrative interfaces;
- protection of credentials and API keys;
- separation of test and live environments where the architecture allows;
- updating software components and dependencies;
- limiting the collection and storage of unnecessary information;
- secure management of backups, where these are maintained.
The specific measures may differ depending on the infrastructure, the external providers and the features of the relevant service. This policy does not guarantee that every listed measure is implemented in every system.
5. Virtual cards and payment data
Where Hackera provides an interface or features related to virtual cards and payment operations, processing is carried out according to the agreed roles and the technical architecture of the specific product.
Where card or payment functions are provided through Stripe or another external provider, the relevant operations are subject to the applicable terms, technical capabilities and approvals of that provider.
Hackera does not claim to be a payment card issuer, a licensed payment institution or a custodian of customer funds, unless this has been duly established for a specific service.
Where applicable and supported by the technical implementation, Hackera aims to:
- limit access to card information;
- use permitted interfaces and integrations;
- avoid storing full card data or security codes where this is not necessary or not permitted;
- prevent public disclosure of API keys and integration secrets;
- provide a suitable channel for reporting suspected unauthorised activity.
Rights and obligations relating to cards are covered further in the Virtual Card and Payment Operations Rules and in the applicable terms of the relevant provider.
6. API and external integrations
API access should be granted only for permitted purposes and within the rights that apply to the integration.
Depending on the technical implementation, measures may include:
- authentication of requests;
- limiting access according to the permissions granted;
- request limits and measures against abuse;
- logging of technical events where appropriate;
- revoking or replacing compromised keys;
- separating test credentials from live credentials.
Users and integration partners are responsible for the secure storage of the keys provided to them and for actions performed using their access credentials, to the extent applicable by law and contract.
API keys, passwords, access tokens and other confidential authentication data must not be published in public repositories or shared through insecure channels.
7. Monitoring, vulnerabilities and security incidents
Where technically possible and appropriate, the systems may use logs, alerts and other monitoring tools to identify suspicious activity, operational errors or potential security incidents.
If a suspected security incident is identified, Hackera aims to assess the problem and take reasonable action within its control. Depending on the circumstances, this may include restricting affected access, revoking compromised credentials, reviewing available technical logs, restoring from available backups or contacting an affected external provider.
The timing and scope of the response depend on the nature of the incident, the information available, the technical systems involved and the responsibilities of external providers.
8. Reporting a security issue
If you identify a potential vulnerability, unauthorised access, exposed credentials or another security issue related to Hackera Rewards, please send a report to:
Email: support@hackera.online
Where possible, include the following information in your report:
- a clear description of the issue;
- the affected page, service or feature;
- the steps to reproduce the issue, if known;
- the potential impact and any suitable screenshots or technical details.
Do not include passwords, full payment card data, card security codes or unnecessary personal information in your report.
Do not access, change, download or disclose other people's information, do not disrupt the services, and do not carry out tests beyond what is necessary to document the suspected issue. Do not publicly disclose an unresolved vulnerability with sensitive details.
Hackera will review reports within its available capacity. Submitting a report does not guarantee a specific response time, reward or other payment. This policy does not create a vulnerability reward (bug bounty) programme unless one is announced separately in writing.
9. Third party services
The platform may depend on external providers of hosting, payment services, communications, analytics tools, identity verification or other technology services.
These providers may apply their own security measures, systems and incident response procedures under their own terms and policies. Hackera does not control every aspect of their infrastructure and cannot guarantee the security or continuous availability of independent third party services.
Where appropriate, users should also report problems relating to a payment service or card provider directly to that provider.
10. Personal data protection and privacy
Personal data processed in connection with the platform is handled in accordance with applicable data protection law and the information in the Privacy Policy.
This policy describes general information security principles. It does not replace the Privacy Policy, the platform Terms of Use or the contractual terms of external providers.
11. Policy updates
Hackera may update this policy when the platform, technical systems, external services, security practices or applicable law change. The latest version is published on this page with the date of the relevant update.
12. Contact
For questions about this policy or to report a security issue, contact:
Imoti 98 EOOD
Company ID (EIK): 207210213
Address: Lyulin 8, 1324 Sofia, Bulgaria
Email: support@hackera.online
Website: https://rewards.hackera.online/
This policy describes general security principles and intended measures. It is not a certificate, an independent security audit or a guarantee that specific technical controls are in place. The actual services and security measures depend on the systems used and the applicable contracts.