Families trust Elderella with health information about the people they care for. If you find a security problem in Elderella, please tell us. This page tells you how to report it, what we promise in return, and what you may and may not do.
How to report
Send an email to security@elderella.com. Tell us:
- where the problem is (the web address, the screen in the app, or the API endpoint),
- the steps to make it happen again,
- what a person could do with it,
- any screenshots or proof-of-concept code.
You do not have to give your name. If you want us to reply, give us a way to contact you. Write in English if you can.
What we promise
- We tell you that we received your report within 3 business days. Usually we reply on the same day.
- We check the problem and tell you if we can confirm it.
- We send you an update at least every 14 days until we fix the problem or decide not to.
- We tell you when the problem is fixed.
- We do not take legal action against you for research that follows this page (see "Safe harbor").
We do not pay rewards for reports.
What we ask of you
- Report the problem to us as soon as you find it.
- Test only with an Elderella account that you made yourself. Do not log in to, change, or read the account of a real family.
- Do only what you must to show that the problem is real. Do not use it to keep access, to move to other systems, or to change or delete data.
- Do not cause problems for families who use Elderella, and do not slow down or stop our service.
- Give us a reasonable time to fix the problem before you tell anyone else about it.
- Do not ask for money in return for not publishing a problem.
If you see personal or health information
Stop at once. Do not open more records than you must to show the problem. Then:
- Send us your report at once. Tell us which records or files you opened and how many.
- Do not send us copies of the data. A description is enough.
- Do not share the data with anyone.
- After you send the report, delete every copy you have.
Your list of what you opened is important. The law can require us to tell each family whose information was exposed. Your list helps us find those families.
What is in scope
www.elderella.com and elderella.comapp.elderella.com (the Elderella web app)alpha.elderella.com (the Elderella API)eld.la (our short links)- The Elderella app for iPhone and for Android
- Any other host under
elderella.com
If you are not sure if a system is in scope, send us an email before you test it.
What is out of scope
- Systems that other companies operate, for example Google Cloud, Cloudflare, Apple and Google app stores, and the services that send our text messages and emails. Report problems in those systems to that company.
- Tests that slow down or stop a service (denial of service).
- Social engineering, for example phishing our team, and physical tests of offices or devices.
- Sending many text messages, calls, invitations or emails through Elderella.
- Many low-quality reports, or reports from a scanner with no proof of an effect.
Safe harbor
If you follow this page in good faith, we consider your research:
- authorized under anti-hacking laws. We will not start or support legal action against you for an accidental, good-faith mistake against this page;
- authorized under laws against the bypass of technical controls. We will not make a claim against you for that bypass;
- exempt from the parts of our Terms of Service that would stop security research, for example "Don't interfere with security or systems". We set those terms aside for this research only.
You must still obey all laws that apply to you. If another party starts legal action against you, and you followed this page, we will tell people that you followed it.
This safe harbor covers only legal claims that Elderella controls. It does not bind other parties.
If you are not sure that your research follows this page, send us an email before you continue.
Last updated: November 3, 2026