RFC 2350 Profile - kununu Security Team ========================================= 1. About this document This document describes the kununu Security Team according to RFC 2350. It is intended to provide the general Internet community and other security teams with basic information. 1.1. Date of Last Update This version was published on 2026-03-27. 1.2 Distribution List for Notifications There is no distribution list for this document. Our RFC 2350 profile is kept up-to-date on the location named in section 1.3. 1.3 Locations where this Document May Be Found The current version of this document is available on our website: https://www.kununu.com/.well-known/rfc-2350.txt 1.4 Authenticating this Document This document is available via HTTPS. It is clearsigned with the following key: https://www.kununu.com/.well-known/openpgpkey/nwse-security.asc 2. Contact Information 2.1 Name of the Team Full name: kununu Security and Technical Risk Management Team Short name: kununu Security Team 2.2 Address kununu GmbH Security and Technical Risk Management Haus am Schottentor Schottering 2-6, 1010 Vienna Vienna Austria 2.3 Time Zone CET (UTC+1) / CEST (UTC+2, daylight saving time) 2.4 Telephone Number +43 676 30 11 466 2.5 Facsimile Number None available. 2.6 Other Telecommunication Options None available. 2.7 Electronic Mail Address security_alerts [at] kununu [dot] com 2.8 Public Keys and Other Encryption Information To encrypt sensitive data, please use our PGP key. - PGP: 0x4DE98B5552A50B92 (RSA, 4096 bits) https://www.kununu.com/.well-known/openpgpkey/kununu-security.asc https://keys.openpgp.org/search?q=A2788A0B8E3A5751 2.9 Team Members Diogo Veira in the Security Engineering Team. Management, liaison and supervision are provided by Rui Barreira (Vice President Engineering). 2.10 Points of Customer Contact The preferred method for contacting the kununu Security Team is via e-mail at: security_alerts [at] kununu [dot] com We can be reached by telephone during regular office hours. For general issues, please contact our support at: https://support.kununu.com/hc/de 3. Charter 3.1 Mission Statement Our mission is to ensure that kununu and its customer data are as secure as possible. We provide a single point of contact for all security issues affecting the kununu for both internal and external parties. 3.2 Sponsorship and/or Affiliation The kununu Security Team is part of kununu GmbH located in Vienna, Austria. 3.3 Authority The Security Team responds to, investigates, and coordinates security incidents on behalf of kununu GmbH. 4. Policies 4.1 Types of Incidents and Level of Support The kununu Security Team addresses all types of information security incidents which occur, or threaten to occur, within its remit. The level of support depends on the severity of the respective incident. We only provide limited direct support to users of the kununu platform. Please contact our support team at: https://support.kununu.com/hc/de 4.2 Cooperation, Interaction and Disclosure of Information Within the process of responding to an incident, we will exchange necessary information with other authorised parties on an appropriate legal basis. The kununu Security Team supports the traffic light protocol for information sharing as published on https://www.first.org/tlp/. Do not send unencrypted e-mails containing information labelled AMBER or RED. We operate under Austrian law. This involves careful handling of personally identifiable data with regards to data protection and privacy laws. We may be obliged to disclose information if required by or under any enactment or by a rule of law or order of a court. 4.3 Communication and Authentication For sensitive information, use encrypted e-mail (our public keys are listed in section 2.8). For non-sensitive information, unencrypted e-mail, fax, or telephone is considered to be sufficient. 5. Services 5.1 Incident Response The kununu Security Team deals with and assists in the technical and organisational aspects of information security incidents. - Analysis of information security incidents within our remit - Assessment of security vulnerabilities 5.2 Proactive Activities - Detect malicious activities within the kununu platform - Generate awareness among kununu's employees and partner organisations - Perform security audits, reviews, and test software applications 6. Incident Reporting Forms Regarding the kununu platform, you may use our regular contact form by going to the topic "Privacy Policy and Security": https://support.kununu.com/hc/de You can report abuse or suspicious activity directly within the kununu platform, e.g. by using the "report as spam" or "report profile" functionality. For all other information regarding security incidents, please contact us via e-mail.