Security Agreement
Practical security information for visitors, project inquiries and responsible vulnerability reports.
Last updated: October 4, 2026. Questions: info@progressive-os.com.
Scope and secure transport
This statement covers the public p-cms.com website and its project inquiry form. Public pages and form submissions use HTTPS. Your own browser and device also affect the safety of a session. Check that the address is p-cms.com before sending an inquiry; do not ignore certificate warnings.
Information storage and access
Inquiries are stored in this site’s Progressive CMS instance for review and response. Administrative access is protected by authentication and the CMS permission system. This statement does not claim independent certification, encryption of every stored record, or a contractual security service level. Security arrangements for a customer’s own deployment belong in that customer’s separate agreement.
Safe project inquiries
Send only information needed to describe your project. Do not include passwords, tokens, payment-card details, identity documents or sensitive customer records. The public form is not a confidential file-transfer channel. Ask us to agree on a suitable channel before sharing sensitive materials.
Browser storage and external links
Optional browser storage follows the choices in Cookie settings. Rejecting optional storage does not prevent an inquiry. Links to external services open resources managed by their own operators; those services have their own security and privacy policies.
Reporting a concern
Report suspected vulnerabilities or accidental exposure to info@progressive-os.com. Include the affected URL, a concise description, the time observed and minimal steps to reproduce. Avoid including secrets or personal data in the report. If information appears exposed, stop accessing it and report its location instead of collecting more records.
Responsible disclosure
Please avoid testing that disrupts availability, accesses another person’s data, changes records or bypasses authorization. A publicly reachable endpoint is not permission to conduct intrusive testing. Coordinate any further investigation with us in writing. This statement does not create a bug-bounty program or grant authorization for otherwise unlawful activity.