Responsible disclosure.

Scope

This policy covers the systems Global Claim Services operates directly:

• globalclaimservices.com — our public website
• portal.globalclaimservices.com — the client portal
• staff.globalclaimservices.com — the staff console

It does not cover third-party services we use, such as our email, hosting or payment providers. If you find an issue with one of those, please report it to the provider concerned rather than to us.

How to report

We do not currently operate a dedicated security mailbox or a bug bounty programme. To report a suspected vulnerability, use our contact form: select “Other” as the type of loss and begin your summary with the words “Security report”, so it is routed to the right team.

Please keep the initial report brief — a short description of the issue and how we can reach you is enough for us to get back to you and agree a secure way to receive the full technical detail. Avoid including sensitive proof-of-concept data in the form itself.

What to include

• The system and URL affected.
• Steps to reproduce the issue, or a short proof of concept.
• What you were able to access or achieve, and the potential impact.
• The date and time you tested, so we can match it against our own logs.
• A way to reach you for follow-up questions.

Safe harbour

If you make a good-faith effort to comply with this policy while researching and reporting a vulnerability, we will not pursue legal action against you for that research, and we will treat your work as authorised. This safe harbour applies only to testing carried out within the scope above and in line with the “What not to do” section below.

What not to do

• Do not access, download, modify or delete data belonging to anyone other than yourself beyond what is strictly necessary to demonstrate the issue.
• Do not run automated scanning at a volume that could degrade the service for others, and never attempt to disrupt or deny service (no DoS or DDoS testing).
• Do not use social engineering, phishing, or attempt to gain physical access to our offices, or those of our staff or clients.
• Do not access, or attempt to access, another person’s account, case file or messages.
• Do not publicly disclose a vulnerability before we have had a reasonable opportunity to investigate and address it.

What we commit to

• We will acknowledge receipt of your report.
• We will investigate every report we receive and keep you informed of our progress in plain language.
• We will let you know once an issue has been addressed, where we are able to.
• We will not pursue legal action against good-faith research that follows this policy.