I've spent a significant amount of time testing Personio and interacting with their security team through responsible disclosure. Overall, the experience has been positive. The security team is professional, communicates clearly, and is willing to discuss technical details rather than relying on generic responses. Reports are reviewed carefully, and when a finding is considered out of scope or not applicable, they generally explain their reasoning instead of sending a canned rejection.