Suspect a security incident involving MosoFin? Email [email protected] with the subject Security incident report. This is our public reporting channel.
What to report
Report suspected unauthorized access to a MosoFin account or workspace, exposure of connected data, misuse of a connection, or a security issue affecting the service. You do not need to prove that an incident occurred before reporting it.
Include what you noticed, when it happened, the affected account or workspace if known, and a way to reach you. Do not email passwords, access tokens, or full financial records. If you found a vulnerability rather than an active incident, use the same address with the subject Security vulnerability.
Roles and responsibilities
- Support: receives reports at the address above, records the details, and routes urgent security concerns to the response team.
- Incident coordinator: is assigned for a confirmed incident, sets priorities, coordinates responders, keeps a decision and event record, and approves customer-facing updates.
- Engineering and security responders: investigate the cause and scope, contain the issue, restore affected service, and check that the fix works.
- Leadership and privacy or legal advisers: review material business impact and any contractual or legal notification obligations.
One person may fill more than one role. Access to incident details is limited to people who need it to respond.
How we respond
We assess reports, prioritize credible incidents by potential impact, and investigate what systems, workspaces, and data may be affected. Responders then work to contain the issue, remove the cause, restore service, and document what happened. Afterward, we review the response and identify follow-up improvements.
Reporting and communications
Inbound: send reports and follow-up information to [email protected]. If you have already reported an issue, reply to the same email thread so the context stays together.
Outbound: when an incident affects customers, MosoFin uses the contact information associated with affected accounts to share relevant updates, actions customers should take, and a resolution notice when appropriate. We also coordinate with connected providers and notify authorities when required. We do not publish sensitive investigation details that could put customers or the service at further risk.
Notification timing and content depend on what we can verify and any applicable legal or contractual requirements. This page does not promise a fixed response or resolution time.
Contact
For setup and other technical questions, start with the MosoFin documentation. If it does not resolve your issue, email [email protected].
For a suspected security incident, email [email protected] directly. For more about MosoFin's access controls, see our security page.