Vulnerability Disclosure Policy

ClaimSorted handles insurance claims and the personal data that comes with them, so we take security reports seriously. If you think you have found a security issue in one of our services, please tell us. We will work with you to understand it and fix it.

How to report

Email security@claimsorted.com with:

• the affected URL or service
• steps to reproduce the issue
• what you think the impact is
• how you would like to be credited, if at all

Please write in English. Send one report per issue.

Scope

In scope: services that ClaimSorted runs on claimsorted.com and its subdomains, including our claims portals and our APIs.

Out of scope:

• systems owned by insurers or other partners, even if they link to us
• third-party services we use (for example Google Workspace, Clerk or Linear)
• denial of service, spam or load testing
• social engineering or phishing of our staff, partners or customers
• physical access to our offices or devices
• automated scanner output with no demonstrated impact, such as missing headers or email DNS records on their own

Rules

When testing, please:

• only use accounts and data that belong to you
• don’t access, change, delete or keep anyone else’s data. If you come across personal data, stop and report it straight away
• don’t degrade or interrupt our services
• don’t share the issue with anyone else until we have fixed it, or agreed a date with you

What we commit to

• reply within 2 working days
• tell you within 5 working days whether we can reproduce the issue and how serious we think it is
• keep you updated while we fix it, and tell you when it is fixed
• credit you on request once the issue is fixed

Safe harbour

If you follow this policy in good faith, we will not take legal action against you or report you to law enforcement for your research. We cannot waive the rights of third parties, and we cannot give immunity from UK law, including the Computer Misuse Act 1990. If you are unsure whether something is allowed, ask us first at security@claimsorted.com.

Rewards

We don’t run a paid bug bounty and we don’t pay for reports. Please don’t ask for payment as a condition of sharing a report. We are happy to thank and credit researchers who help us.