Security Policy
A practical overview of the website's protective measures and how to report a potential vulnerability.
Current website controls
The website is served over HTTPS and uses Cloudflare infrastructure. Public enquiry submissions are validated on the server, size-limited and protected with basic bot checks. Email delivery credentials are stored on the server, and outgoing SMTP transport uses encryption where configured.
These are specific measures observed in the application. They are not a guarantee that the website, infrastructure, suppliers or all data are immune to attack. We make no unverified ISO, SOC 2, penetration testing or incident response certification claims.
Report a concern
For a suspected vulnerability, send a private report to [email protected] with the affected URL, a clear description, relevant screenshots and safe steps to reproduce. Please avoid sharing passwords, personal data or exploitable details publicly.
Responsible testing
Do not access other users’ data, run denial-of-service tests, attempt persistent access, bypass authorisation, modify content or disrupt production. Testing that could affect accounts, visitors or availability requires prior written agreement. This page does not constitute broad testing authorisation or a bug bounty offer.
Privacy and incident questions
Security reports that include personal data are handled through the same contact channel as privacy requests. For how enquiry details and related data are processed, see the Privacy Policy and the KVKK Information Notice.
Questions or requests?
For privacy requests and responsible security reports, use our contact address.
Privacy & Security overview →