Responsible disclosure

Our commitment

We hold sensitive material for law enforcement agencies and regulated institutions. The security of our systems is not a secondary concern for us, and we would rather learn about a weakness from a researcher than from an incident.

If you report a vulnerability in good faith and in line with this policy, we will not pursue or support legal action against you in respect of your research. We will acknowledge your report, keep you informed, and credit you publicly if you would like us to.

In scope

Our public website and its supporting infrastructure, our published applications and APIs, and our corporate email and authentication systems.

Out of scope

Third party services we merely use, denial of service testing, physical attacks, social engineering directed at our staff or clients, and automated scanner output submitted without a demonstrated impact. Reports consisting only of missing headers or of findings with no realistic exploitation path are unlikely to be actionable.

How to report

Send your report to our security address with enough detail to reproduce the issue: the affected system, the steps taken, and what an attacker could achieve. If you are able to encrypt your report, please do.

We will acknowledge within three working days, give you an assessment within ten working days, and keep you updated until the issue is resolved. Please allow us ninety days to remediate before any public disclosure, and talk to us if you believe a shorter period is warranted.

What we ask of you

Work only on systems within scope. Do not access, modify or delete data belonging to anyone else. If you encounter personal data or client material, stop, do not retain a copy, and tell us immediately. Do not degrade our services for other users. Do not use a finding to extract payment as a condition of disclosure.

Rewards

We are an early stage company and do not currently operate a paid bounty programme. We offer acknowledgement, credit where wanted, and a genuinely responsive process. We would rather be honest about that than imply a payment we cannot make.

If you are reporting something else

This policy covers vulnerabilities in our own systems. If you are reporting a crime, or you are the victim of a fraud, please use the contact route on this site and read the notices there first. If you believe you have information about criminal conduct, report it to the police.