Security Policy

1Purpose

Canadian Association for Financial Empowerment (CAFE) operates credentialing and verification systems that support professional standards for financial counselling. Security is part of that trust.

We steward information with strong privacy discipline. CAFE designs in alignment with the spirit of OCAP^® and recognises distinct First Nations, Métis, and Inuit data sovereignty frameworks; the Data Sovereignty Statement governs our approach in detail.

3No unsolicited testing

CAFE does not operate a bug bounty program and does not authorise unsolicited security testing, scanning, probing, exploitation, or validation activity against our systems.

Activity that attempts to identify, confirm, or exploit vulnerabilities without explicit written authorisation may be treated as unauthorised access behaviour and handled under applicable Canadian law and our internal incident response processes.

4What to include in a report

• Impacted URL, subdomain, or system component
• Non-destructive steps to reproduce
• What you observed and why you believe it is a vulnerability
• Date and time discovered (include timezone)
• Evidence that avoids personal data, client data, and credential content

5What we ask you not to do

• Do not access, copy, alter, or delete data
• Do not attempt account access, privilege escalation, or lateral movement
• Do not run denial-of-service tests or high-volume scanning
• Do not publicly disclose details before we have assessed and remediated the issue

6Scope

This policy applies to:

• certification.cafe-acaf.org and subdomains
• Portal infrastructure supporting credential issuance and verification
• APIs served from the certification portal
• Certificate verification systems
• The CFC™ directory and related public endpoints

For issues involving www.cafe-acaf.org (Squarespace-hosted), report through Squarespace support channels and notify CAFE if the issue affects CAFE users or credentialing workflows.

7Authorised research by consent

We respect legitimate security research and welcome collaboration conducted by consent, with defined scope, written authorisation, and safeguards appropriate to credentialing and privacy-sensitive systems.

If you wish to propose an authorised engagement, contact compliance@cafe-acaf.org. Research partnerships may be acknowledged publicly where appropriate.

8Foreign legal process

The CAFE Certification Command Centre is hosted on the Serving Ethics server, a Canadian-located server stewarded by William Moores. No third-party cloud provider holds the platform itself, and no US-citizen administrative access stands between user data and the platform.

The US Clarifying Lawful Overseas Use of Data Act (CLOUD Act) compels US-domiciled vendors to disclose data in their custody regardless of where the data is physically stored. The USA PATRIOT Act may further impose a gag clause that prevents the affected party from being notified. The Office of the Privacy Commissioner of Canada has confirmed that Canadian data residency alone cannot guarantee protection from foreign legal processes when the responsible vendor is US-domiciled.