Sign inRequest access
Trust & responsible disclosure

Security

Mount Thor operates a security program for its bare-metal macOS platform and welcomes good-faith reports through a defined vulnerability disclosure process.

Current assurance status

SOC 2 readiness is in progress. Mount Thor does not currently claim SOC 2 certification or a completed SOC 2 Type 2 audit.

Review Mount Thor’s security controls and available assurance materials in our Trust Center. Materials subject to access or confidentiality requirements can be requested there.

View Trust Center ↗

Security program

  • AWS multi-account isolation with account-scoped infrastructure as code and production guardrails.
  • Central identity, multi-factor authentication, least-privilege roles, and reviewed access paths.
  • Encryption in transit and at rest, managed trust chains, and secrets-management controls.
  • Central logging, security monitoring, vulnerability management, and incident-response procedures.
  • Peer-reviewed changes, automated testing, dependency scanning, and controlled deployment workflows.
  • Personnel, vendor, continuity, data-management, and secure-development policies reviewed on a recurring basis.

Report a vulnerability

Email a concise report with the affected hostname or component, impact, reproduction steps, and supporting evidence. Use test data and the minimum interaction needed to establish the issue.

Security reports

We target acknowledgment within five business days and an initial triage update within ten business days. This is a disclosure program, not a paid bug bounty.

Scope and boundaries

In scope: public Mount Thor domains and services that Mount Thor directly operates, unless a service-specific notice says otherwise.

Out of scope: customer environments, third-party services, social engineering, physical attacks, denial of service, high-volume automated scanning, credential stuffing, spam, and findings that require accessing another person’s data. Stop testing immediately if you encounter customer content, credentials, or evidence of active compromise.

Safe harbor and disclosure

Mount Thor will not pursue legal action against researchers who act in good faith, stay within this policy, avoid privacy violations and operational harm, do not retain data, and provide a reasonable opportunity to remediate. This safe harbor does not authorize conduct against third parties or conduct prohibited by law.

Do not publicly disclose a report before Mount Thor confirms remediation or before a mutually agreed disclosure date. We generally aim to coordinate within 90 days, but severity, dependencies, and customer safety may require a different timeline.

The machine-readable policy is available at /.well-known/security.txt.