Legal / Responsible Disclosure Policy

Responsible Disclosure Policy

Report a vulnerability in good faith and we will not come after you.

Version 1.3 · last updated 2 October 2026

If you find a security problem in Top Billing, please tell us. This page is our commitment about what happens next.

In scope

• topbilling.in, app.topbilling.in and api.topbilling.in, and the services behind them.
• Authentication, session handling, authorisation between accounts and projects, and the administrative console.
• Anything that lets one account see or spend another account's data or credits, bypass billing, or read a secret.

Out of scope

• Automated scanner output with no demonstrated impact, missing hardening headers that are already compensated for, and best-practice opinions with no exploit path.
• Denial of service, volumetric or resource-exhaustion testing, and anything that degrades the Service for other customers.
• Social engineering of us or of our customers, physical attacks, and attacks on our providers' own infrastructure.
• Weaknesses in a third-party service — report those to the third party; tell us as well and we will chase it.

Our commitment

• We acknowledge your report within 2 working days and give you our assessment within 10 working days.
• Safe harbour: if you follow this policy in good faith, we will not bring or support a legal claim against you for the research, and we will confirm that in writing if you need it. It does not cover accessing, changing, taking or destroying data that is not yours, and it does not cover extortion.
• We will credit you by name when we publish the fix, if you want that, and we will agree the timing with you. We aim to fix and disclose within 90 days.
• We do not run a paid bug bounty today and will not pretend otherwise. Asking whether one exists is fine; demanding money in exchange for silence ends the safe harbour.

How to report

Email support@topbilling.in with "security" in the subject. Include what you found, how to reproduce it, what an attacker could do with it, and how you would like to be credited. Test with one account you control, stop as soon as you have proved the problem, and do not look at other people's data. If you see customer data by accident, stop, tell us, and delete what you have.

Other documents

• Terms of Service — The agreement between you and VD Enterprises for using Top Billing.
• Acceptable Use Policy — What you may not do with the Service, and what happens if you do.
• Privacy Policy — What personal data we process, why, where it goes, how long we keep it, and your rights.
• Cookie Policy — The only cookies we set are the ones that keep you signed in.
• Data Processing Addendum — The processor terms that apply when you route personal data you are responsible for through the Service.
• Sub-processors — Every third party that processes data on our behalf, what for, and where.
• Credits, Refunds and Cancellation Policy — How prepaid credits work, what is charged, and when money comes back.
• Service Delivery Policy — Nothing is shipped. What you buy is available within minutes, and usually at once.
• Referral Programme Terms — Invite someone, and when they top up you get credits. The exact rules.
• Service Level and Support Policy — What we aim for on availability and response, stated as targets rather than promises.
• Grievance Redressal Policy — How to complain, what we must do about it, and where to go if we fail you.
• About and business details — The registered identity behind Top Billing, as the e-commerce disclosure rules expect.
• Contact — How to reach us, and what to include so the first reply is a useful one.