Security

Reporting a vulnerability

Updated 4 November 2026

Enarra Memo (formerly Tarumo) is a service of Enarra Oy, and it stores the knowledge of experts at companies. That is why security matters to us. If you find a vulnerability in Enarra Memo or in the services of this website, please tell us. This page explains how to report it, what research may include and what happens after your report.

How to report

• Write to security@enarra.fi.
• Tell us what you found, where (the address or the feature), how to reproduce it and what it could be used for. A screenshot or a short list of steps is enough.
• Please do not attach customer data or passwords. If you want to send sensitive material, first ask for an encrypted way in a reply.
• You can write in Finnish or English. The contact details and the expiry date are also in the security.txt file.

Research in good faith

We allow security research that is done in good faith and within these limits. As a starting point, we will not take action against a researcher who follows these rules and reports the findings to us. This does not permit unlawful activity and does not cover other parties’ services, for example our subcontractors.

• Test only with your own user account and your own data.
• Do not change, delete or copy other people’s data, and do not try to reach another organisation’s data.
• Do not run denial-of-service attacks, load tests or mass automated scanning.
• Do not use social engineering and do not target Enarra Memo’s users or staff. Physical intrusion is not allowed.
• Do not leave lasting changes, backdoors or malware in the service, and do not use a flaw for longer than it takes to demonstrate it.
• Give us reasonable time to fix the issue before you tell others. We will agree on a schedule together.

No access to customer data

Customer data belongs to the customers. Research must not aim at reaching customer data, and any such access may not be used. If you come across a customer’s data during your research, stop at once, do not save or copy it, and tell us what happened. We treat it as a security incident.

What happens after your report

1. We acknowledge your report within five working days.
2. We assess the finding and ask for more information if needed.
3. We fix the vulnerability in order of its severity and tell you when it is fixed.
4. If you wish, we credit you with thanks when the fix is published. We do not pay rewards for findings.

If a vulnerability may have exposed personal data, we act according to our handling of personal data breaches and notify those concerned as required.

For questions other than security, write to sales@enarra.fi. Matters concerning personal data are explained in the privacy notice.