Legal

Security

Last updated: July 2026

We take the security of our software and your data seriously. If you believe you have found a security vulnerability or wish to report a security incident, please let us know immediately.

01Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly by emailing us at:

paul@better-call-sam.co.uk

Please do not report security vulnerabilities through public GitHub issues or other public channels.

02What to Include

  1. A description of the vulnerability and its potential impact
  2. Steps to reproduce the issue
  3. Any relevant screenshots or proof of concept
  4. Your contact details so we can follow up

03Our Commitment

  • We will acknowledge your report within 2 business days
  • We will investigate and provide an initial assessment within 5 business days
  • We will keep you informed of progress towards a fix
  • We will not take legal action against researchers who report responsibly
  • If an incident affects personal data, we will report it to HMRC and the Information Commissioner's Office within 72 hours

04Security Practices

  • All data is transmitted over encrypted connections (TLS)
  • OAuth tokens are encrypted at rest using AES-256-GCM
  • We send the fraud prevention headers HMRC requires for our type of application
  • No customer credentials are stored by our application
  • All data is stored on servers located in the United Kingdom