Data security is a shared responsibility of Vomi and every user. If you notice anything suspicious, contact us immediately — even if you are not sure. We would rather check a false alarm than miss a real incident.
1. What to report
- suspicion that someone has accessed your account (unknown logins, actions you did not take, a login notification you did not request);
- a lost or stolen device used to access the Application;
- a password or code you disclosed to someone else, including through a fake message or website (phishing);
- incorrectly assigned permissions — you can see a client, employee or module you should not see;
- personal data sent to the wrong person, or a document appearing in the wrong place;
- any other sign of data leakage or unauthorised modification.
2. How to report
In your report, describe what you noticed, when, from which account and device, and whether you have already taken any action. Do not send passwords or employee personal data in the report.
3. What to do immediately
- change your password and, if possible, log out of all active sessions;
- do not delete suspicious messages or records — they may help establish what happened;
- if it concerns a staff member who has left your company, request immediate removal of their access.
4. What we do
We acknowledge your report, assess the risk and restrict access immediately where needed. If the incident is a breach of personal data we process for a client, we notify the client within 24 hours of becoming aware of it, so that the client can notify AZOP within 72 hours (Annex 1, Section G of the Terms of Use). Where we are the controller, we notify AZOP and, where required, the affected individuals ourselves.
5. Reporting vulnerabilities
If you discover a security flaw in the Application, report it to the address above. Please do not exploit it, access other people's data or disclose it publicly before we have fixed it.