Reporting a Security Problem

Tax offices trust TaxPulse with their clients' most sensitive information, and we take every report of a security problem seriously. If you believe you have found one, this page explains how to tell us.

1. How to report

Email support@taxpulse.biz with "Security report" in the subject. Send one email per problem, and include:

• the page or web address affected;
• the exact steps to reproduce it;
• what you saw happen, and what you expected instead;
• screenshots or requests and responses, with any personal data removed.

Reports are handled in writing only. We do not hold meetings or calls about a report before we have received it in writing.

2. What we ask of you

• Use only your own account, or a test account you created. Never open, change or keep another person's data.
• If you reach data that is not yours by accident, stop, do not save it, and tell us straight away.
• Do not run tests that slow down or interrupt the service, send messages or calls to real people, or try to trick our staff or customers.
• Give us a reasonable time to fix a problem before you tell anyone else about it.

3. What to expect from us

• We confirm we received your report, normally within three business days.
• We investigate it and tell you whether we could reproduce it.
• We tell you when a problem you reported has been fixed.

4. Rewards

TaxPulse does not run a paid bug bounty program, and we do not pay for reports or for meetings about them. We are grateful for every report that helps keep tax offices and their clients safe.

5. Out of scope

Reports produced only by an automated scanner, with no demonstrated effect, are not normally acted on. Neither are missing best-practice headers on pages that hold no data, or problems that need a device or email account that is already in someone else's control.