Security and Updates Policy

1. Security support for Benedict App

For a new paid Benedict App license, the included security support period is five years from the purchase date, or longer where mandatory law requires. Our confirmation email after purchase states the applicable end-of-support date. A longer period expressly promised at purchase remains binding. Other products and separately identified open-source editions have the support terms stated for those products; this policy does not silently change their licenses.

During that period we investigate reported vulnerabilities in the covered product and make necessary security fixes available without an additional license or maintenance fee. Response and remediation depend on severity, exploitability and available mitigations; no fixed response-time SLA is included. We may provide mitigation instructions while preparing a fix. This does not postpone any mandatory reporting or remediation deadline.

Security support is different from custom development, new features, deployment assistance and operating your Azure environment. You are responsible for installing available updates and following reasonable security instructions. We will identify supported versions and required update steps. Where we address an issue through a newer version, we will preserve the free security-update entitlement and meet any applicable legal requirements concerning migration and additional environment costs.

2. Released updates and continued use

Each security update issued under this policy will remain available for at least ten years after its release, or for the remaining support period if that is longer. This is an availability period for already released updates, not a promise to develop new features or provide personal assistance for ten years.

Every Benedict App release package is digitally signed by us, and the installer checks the signature and that it is an official build before using it. Updates are never installed automatically. We may use a verified download service or provide an update on request after confirming entitlement. If a normal delivery channel changes, we will provide a reasonable alternative. We will not charge a new license fee merely to obtain a security update included in your entitlement.

If we discontinue the product or its license infrastructure, we will give reasonable notice where practicable and provide a practical continuity arrangement for valid perpetual licenses, such as a final installation package with a usable recovery or offline activation method. Existing support and update-availability commitments are not canceled simply by removing a product from sale. This does not guarantee that third-party platforms will operate forever.

3. Security notices and contact information

We use the purchase or designated security contact address for important product security notices. These are service messages, not a subscription to advertising. You may nominate a replacement contact, including an organization’s shared security mailbox, without buying another license.

If you ask us to delete a contact address, we will assess the request under our Privacy Policy. If no usable contact address remains, we may be unable to notify you directly about a critical vulnerability or an available security update. You should then check this page and the release information yourself, or provide another contact address.

If license-verification data are lawfully deleted, automatic recognition of your update or reinstallation entitlement may no longer work. We will offer reasonable alternative verification using your receipt or other proof of purchase. Deleting contact data does not by itself cancel your license, remove an update entitlement or allow us to withhold a security fix that we must provide.

The ten-year update-availability commitment does not require blanket retention of all customer personal data for ten years. We retain only records justified for their particular purpose, as described in our Privacy Policy.

4. Report a vulnerability

Email info@benedictcorp.com with the subject “Security vulnerability — Benedict App”. Include the affected version, a description, likely impact and safe reproduction steps. Do not send passwords, access tokens or unnecessary personal data. Ask for a suitable secure transfer method before sending sensitive material.

We will assess the report, coordinate a response and communicate appropriate remediation information. Please avoid accessing another person’s data, interrupting services or publicly releasing exploit details before reasonable coordination. This request does not prohibit lawful reporting to authorities or override legal disclosure obligations. We do not promise a paid bug bounty unless separately agreed.