1. Purpose

This policy outlines how to report security issues safely and how we commit to respond.
It supports our wider Cybersecurity Statement and Data Protection Policy.

2. Scope

This policy applies to all public-facing systems owned by Point 1 Solutions Ltd, including:
CompareYourBusinessCosts.co.uk and associated subdomains.

3. Reporting Guidelines

• Do not access, modify, or delete data belonging to others.
• Do not disrupt or degrade services.
• Act in good faith to avoid privacy or data-loss risks.
• Provide detailed information so we can reproduce the issue (URL, description, proof of concept if possible).
• Report privately to our Security Team and allow reasonable time for resolution before public disclosure.

4. How to Report a Vulnerability

Please email our Security Team at:
Email: security@compareyourbusinesscosts.co.uk
Subject line: “Responsible Disclosure Report”

Include the following information where possible:

• System or page where the issue was found
• Type of vulnerability (e.g. XSS, authentication bypass, misconfiguration)
• Steps to reproduce
• Impact and any mitigation suggestions

5. Our Response Commitment

We will:

• Acknowledge receipt within 3 business days.
• Assess and verify the issue promptly.
• Keep you updated on progress and resolution time frames.
• Credit you by name (if requested and safe to do so) once the issue is resolved.

6. Legal Safe Harbour

We will not take legal action against researchers who:

• Act in good faith and comply with this policy.
• Do not access data without authorisation or cause harm to systems.
• Report vulnerabilities promptly and confidentially to our Security Team.

7. Out of Scope

The following are not considered security vulnerabilities:

• Spam or social-engineering reports
• Outdated browser warnings or missing HTTP headers without impact
• Denial-of-Service (DDoS) tests or brute-force attacks
• Issues on third-party platforms not controlled by us

8. Review and Updates

This policy is reviewed annually by our Compliance and Security Teams to ensure ongoing alignment with industry best practice and legal guidance from the UK National Cyber Security Centre (NCSC).