Security Policy

Last updated: September 24, 2026

Memberlyst takes the security of our members’ and customers’ information seriously. We welcome reports from security researchers and will work with you in good faith to verify and fix genuine issues.

Reporting a vulnerability

Please email security at memberlyst dot com with:

  • a description of the issue and where you found it (URL, app, or endpoint),
  • the steps to reproduce it,
  • its potential impact, and
  • any proof-of-concept details that help us confirm it.

We aim to acknowledge reports within 5 business days and to keep you updated as we investigate and remediate. Please give us a reasonable amount of time to resolve an issue before disclosing it publicly.

Scope

In scope:

  • the Memberlyst website and web application (memberlyst.com and its organization subdomains),
  • the Memberlyst mobile apps for iOS and Android.

Safe harbour

If you make a good-faith effort to comply with this policy during your research, we will consider your research authorized, we will work with you to understand and resolve the issue quickly, and we will not pursue or support legal action against you.

To stay in good faith, please:

  • only interact with accounts you own or have explicit permission to test,
  • avoid accessing, modifying, or deleting other people’s data,
  • avoid privacy violations, service disruption, and data destruction,
  • do not run automated scanning that degrades the service, and
  • give us reasonable time to remediate before public disclosure.

Out of scope

  • Denial-of-service (DoS/DDoS) and volumetric attacks.
  • Social engineering of our staff, customers, or their members.
  • Physical attacks against property or people.
  • Spam, or reports from automated tools without a demonstrated, exploitable impact.

Our practices

We protect information with encryption in transit and encryption of sensitive stored values, per-organization data isolation, least-privilege access, off-site encrypted backups, and ongoing security review. See our privacy policy for how we handle personal information.

Contact

security at memberlyst dot com