Responsible Vulnerability Disclosure

We welcome reports of security vulnerabilities from security researchers, customers and members of the public. This page explains how to report, what to expect, and the boundaries within which we ask researchers to work.

How to report

Please email security@propertyportfoliosuite.com with a description of the issue, steps to reproduce, and any supporting evidence. We will acknowledge receipt within two working days.

In scope

The application served at this domain and its sub-domains
Authentication, session management and 2FA flows
The audit-log and sensitive-credential reveal flows
API endpoints under /api/*

Out of scope

Social engineering of customers or staff
Physical intrusion attempts
Denial-of-service testing
Automated vulnerability scanning that generates volume traffic
Third-party sub-processors listed at /trust/sub-processors

Please do not access, modify or exfiltrate data that is not your own. Use test accounts only. Stop testing as soon as you have evidence of a vulnerability and report it.

Our commitments

We will acknowledge your report within two working days.
We will provide an initial assessment of severity and an expected timeline within five working days.
We will keep you informed as we work on a fix.
We will credit you publicly, if you wish, once the issue is resolved.
We will not pursue legal action against researchers who act in good faith within this policy.

Back to Trust & Security

Cookie Notice

We use only strictly necessary cookies to keep you signed in and protect your account. No advertising, no tracking, no third-party analytics.