Security and Vulnerability Disclosure

1. Protect your account

• RHYS will never ask you for your PIN, your password or your 2FA code: not by chat, not by email and not by WhatsApp.
• Turn on two-step verification with an authenticator app. It is mandatory to create and pay for deals, withdraw, send balance with a PIN and pay for promotions with the Wallet.
• Use a unique password and a PIN that nobody else knows. If they are leaked, you are responsible for the operations carried out with them, except in the event of a RHYS security failure.
• Review your open sessions and close any you do not recognise.
• If you think someone has accessed your account, change your password and tell us immediately at [email protected] or through the Help Centre.
• If you lose funds due to a proven RHYS security failure, we will reimburse them.

2. How to report a vulnerability

Write to [email protected] with the subject «Seguridad» (Security). Include:

• What you found and on which page or feature.
• The steps to reproduce it.
• The impact you believe it has.
• How to contact you.

We will confirm that we have received it and let you know when it has been fixed.

3. Rules for reporting

• Use only your own accounts or test accounts. Do not access, change or delete other people's data.
• Do not carry out denial-of-service attacks, spam, social engineering or physical tests.
• Do not move other users' money or keep any funds.
• Stop testing as soon as you confirm the flaw and do not keep third-party data.
• Do not publish the flaw until we have fixed it.

4. Safe harbour and acknowledgement

• If you follow these rules and act in good faith, we will not take legal action against you for your research.
• We do not pay monetary rewards. If you wish, we will publicly acknowledge you as the author of the report.

This English version is provided for convenience. If there is any inconsistency, the Spanish version prevails, except where mandatory law provides otherwise.