Responsible Disclosure Policy

My Waypoint Technologies Inc. is committed to the security of our products and services. We welcome responsible disclosure of security vulnerabilities from security researchers, customers, and the public.

This policy describes how to report a vulnerability, what to expect after reporting, and the protections available to good-faith reporters.

This policy applies to security vulnerabilities in:

• MyWaypoint Trust Centre (mytrustcentre.ca)
• MyCleanData (mycleandata.ca)
• MyData101 (mydata101.ca)
• MyDataTools (mydatatools.ca)
• MyDataHub (mydatahub.ca)
• MyDataOnDemand (mydataondemand.ca)
• MyWaypointDigital (mywaypointdigital.ca)
• legal-cannabis.ca
• Any other MyWaypoint-operated infrastructure

This policy does not cover third-party services used by MyWaypoint products (such as Stripe, AWS, or Google Maps Platform). Vulnerabilities in those services should be reported directly to those providers.

To report a security vulnerability, email: security@mywaypoint.ca

Please include:

• Description of the vulnerability
• Steps to reproduce the issue
• Affected URL, endpoint, product, or service
• Potential impact
• Your contact information (optional, but helpful for follow-up)

You must not exploit, access, modify, delete, download, or disclose data that does not belong to you. You must not conduct denial-of-service attacks, social engineering, or physical security testing.

After you submit a report:

• We will acknowledge receipt of your report within 1 business day
• We will investigate the reported issue using reasonable efforts
• We will communicate our findings and any remediation steps
• We will notify you when the issue is resolved

We do not guarantee specific resolution timelines. Resolution time depends on the severity and complexity of the reported issue.

My Waypoint Technologies Inc. will not initiate or recommend legal action against any individual or organization that discovers and reports a security vulnerability in good faith in accordance with this policy.

This safe harbour applies where the reporter:

• Complies with this Responsible Disclosure Policy in all respects
• Does not access, copy, modify, delete, exfiltrate, or disclose any data beyond the minimum necessary to demonstrate the existence of the vulnerability
• Does not conduct or attempt denial-of-service attacks, social engineering, phishing, physical security testing, or any attack against My Waypoint Technologies Inc. personnel
• Does not disrupt, degrade, or interfere with the availability or integrity of any MyWaypoint service
• Reports the vulnerability to My Waypoint Technologies Inc. before any public disclosure and allows a reasonable period for investigation and remediation

This safe harbour is extended in good faith. It does not authorize any activity that would constitute a criminal offence under the Criminal Code of Canada or any other applicable law, and it does not limit the rights of My Waypoint Technologies Inc. to respond to conduct that falls outside the scope of this policy.

This policy is governed by the laws of the Province of British Columbia and the federal laws of Canada applicable therein.