ReturnMateSecurity and ReturnMate
Security matters when handling tax and financial information. Our development requirements cover access control, encryption, secure document handling, incident response, and regular testing. A description of these requirements is not a certification of the software.
This website
The marketing website contains product information and demonstration data. It does not accept tax records, HMRC credentials, payments, or customer document uploads. Please do not send sensitive tax information through ordinary correspondence when reporting an issue.
Reporting a concern
If you already have ReturnMate correspondence or a service agreement, use its contact method to report a security concern. Mark your message as a security report. Include the affected page or feature, what happened, the time observed, and a safe way for us to respond.
Provide reproduction steps using demonstration data where possible. Do not include passwords, authorisation tokens, bank statements, or another person’s records. If an issue concerns the hosting or account platform rather than ReturnMate’s page content, use that provider’s official security-reporting channel.
Responsible reporting
Stop testing if you encounter another person’s information. Do not extract data, disrupt services, attempt social engineering, or test third-party systems. Reporting an issue does not grant permission for intrusive security testing or establish a bounty agreement.
Handling reports
Our response policy is to assess reports promptly, minimise further exposure, and share appropriate updates with the reporter. Where notification duties apply, the responsible organisation must follow the relevant reporting rules and deadlines. Please avoid public disclosure of an unresolved vulnerability while the issue is being investigated.