diff --git a/.github/SECURITY.md b/.github/SECURITY.md
deleted file mode 100644
index b2d1477..0000000
--- a/.github/SECURITY.md
+++ /dev/null
@@ -1,23 +0,0 @@
-# Security Policy
-
-## Supported versions
-
-ColdFront is under active development; security fixes are applied to the `main`
-branch and released from there.
-
-## Reporting a vulnerability
-
-**Please do not open a public issue for security vulnerabilities.**
-
-Report privately through GitHub's **Security Advisories** — use
-**[Report a vulnerability](https://github.com/pgEdge/ColdFront/security/advisories/new)**
-on the repository's *Security* tab. Please include:
-
-- a description of the vulnerability and its impact,
-- steps to reproduce or a proof of concept,
-- the affected version / commit,
-- any suggested remediation.
-
-We will acknowledge the report, investigate, and keep you updated on progress and
-the fix timeline. Please allow a reasonable disclosure window before any public
-discussion.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..3ba2905
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,36 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities to **security@pgedge.com**, which
+reaches the pgEdge security team.
+
+Please do not open a public issue for a suspected vulnerability.
+
+Tell us the product and version, what the impact is, and how to reproduce
+it. You do not need to sign anything or hold a pgEdge contract to report to
+us.
+
+We acknowledge reports within five business days, tell you the outcome of
+our assessment, and tell you before we publish anything.
+
+## Supported Versions
+
+Security fixes are provided for the latest release of each product. Where a
+product has its own published support lifecycle, that lifecycle governs.
+
+## Scope and Safe Harbour
+
+What is in scope, our safe harbour terms, and how we handle coordinated
+disclosure and CVE identifiers are all set out in the pgEdge Vulnerability
+Disclosure Statement:
+
+**https://docs.pgedge.com/security**
+
+You may test this software freely in an environment you control. Testing
+pgEdge Cloud requires prior written authorisation — see the statement.
+
+## Published Advisories
+
+Advisories are published under the Security tab of the repository for the
+affected product.