Security

Email us at security@billance.de. You don't need a Billance account, and you can write to us in German or English. It helps us most if you include: • the affected product with platform and version, for example Billance for Windows 2026.2.4 or billance.de • a description of the vulnerability and its possible impact • the steps we can use to reproduce it • how we can reach you for follow-up questions Please don't report security vulnerabilities via the contact form, the in-app feedback or publicly, for example in forums or on social media.

This policy covers: • the Billance apps for Windows, macOS, Linux, iOS and Android • the website billance.de and the online services used by the apps, such as sign-in, license checks, updates and Billance AI Please report vulnerabilities in services of other providers, for example Stripe, Apple, Google, Microsoft or your cloud storage, directly to the respective provider.

• We personally confirm receipt of your report within five working days. • We review the report, keep you informed about the progress and agree with you on when details will be published. • We fix confirmed vulnerabilities as quickly as possible and provide security updates free of charge. • After the fix, we publish information about the vulnerability, usually within 90 days of your report. If you wish, we will credit you by name. • As required by law, we report actively exploited vulnerabilities to the German Federal Office for Information Security (BSI) and the European Union Agency for Cybersecurity (ENISA).

• Give us reasonable time to fix the vulnerability before you publish details or share them with third parties. • Only access systems and data to the extent necessary to demonstrate the vulnerability. Do not access other users' data, and do not modify or delete any data. • Refrain from attacks that affect availability (for example denial of service), social engineering, phishing and physical attacks. • Delete any data you obtained during your testing as soon as you no longer need it for the report.

If you act in good faith and follow this policy, we will not take legal action against you and will not file a criminal complaint. We do not require a non-disclosure agreement. We currently do not offer a bug bounty program with rewards.

You receive security updates free of charge through the automatic updates in Billance or through the app store you installed Billance from. Please always keep Billance up to date.

There are currently no published security advisories. We publish information about fixed vulnerabilities on this page.