Security & disclosure statement
Provisional draft · 2026-10-17-draft-1 · 17 October 2026
1. Scope
This provisional statement describes intended safe use and existing access boundaries, not a security certification, penetration-test report or guaranteed service level. No ISO, SOC or other accreditation is claimed.
2. Account safety
Use strong unique credentials, protect devices and limit account permissions. Organisations manage authorised users and should remove access promptly when roles change. Do not share sign-in links or private token links beyond intended recipients.
3. Records and support
Organisation boundaries and role-based access protect records. Sensitive communication content has controlled reveal actions. Where client account support access requires approval, it is time-limited. Users must still choose recipients carefully and handle downloaded reports securely.
4. Responsible disclosure
Report suspected vulnerabilities through Contact or platform support, giving a description and safe reproduction details without unnecessary personal data. Do not access other users’ records, disrupt service or publish exploitable details before remediation. This is not a promise of a bug bounty.
5. Incident and assurance enquiries
Request confirmed security measures, processing locations, incident contacts and retention arrangements before high-risk use. Response commitments must be stated in the final service agreement; no invented notification deadline or recovery guarantee is provided here.