Polo HQ Security and Responsible Disclosure Policy

Effective date: 30 July 2026

Polo HQ takes the security of the Service and Customer Data seriously. This Policy explains how authorised security researchers and users may report suspected vulnerabilities.

It does not authorise access to another person's data, disruption, social engineering, extortion, copying of proprietary material or any activity prohibited by law or the Polo HQ Terms of Service.

1. Reporting a vulnerability

Send a report to info@polohq.com with the subject Security Vulnerability Report.

Include:

• your name and a safe contact method;

• the affected URL, feature, API or application version;

• a clear description of the suspected vulnerability;

• reproducible steps using the minimum data and access necessary;

• the potential impact;

• relevant timestamps, request identifiers or redacted evidence; and

• whether you have disclosed the issue to anyone else.

Do not include unnecessary personal data, full credentials, full payment information or Customer Data in the report.

2. Good-faith research conditions

Polo HQ will treat research as good faith where the researcher:

• acts solely to identify and report a genuine security issue;

• uses their own Account, Trial or data, unless expressly authorised otherwise;

• avoids accessing, downloading, changing or deleting another person's data;

• avoids privacy violations and unnecessary data exposure;

• does not degrade, interrupt or deny service;

• does not use automated scanning at a volume that could affect availability;

• does not exploit a vulnerability beyond what is minimally necessary to demonstrate it;

• reports promptly and allows reasonable time for investigation and remediation;

• keeps vulnerability details confidential until Polo HQ agrees to disclosure or a reasonable remediation period has passed; and

• complies with applicable law.

This Policy is not a promise that every activity is lawful and is not legal advice. A researcher remains responsible for their conduct.

3. Prohibited testing

Unless Polo HQ gives express written authorisation, do not perform:

• denial-of-service or load testing;

• destructive testing or data deletion;

• phishing, pretexting, social engineering or physical attacks;

• credential stuffing, password spraying or brute-force attacks;

• malware delivery or persistence;

• testing against another Customer's Account or production data;

• bulk scraping or extraction;

• circumvention of payment, capacity, access or licensing controls;

• attacks against Stripe, Supabase, Resend, Vercel or another third party; or

• publication or sale of a vulnerability before coordinated remediation.

4. What Polo HQ will do

Polo HQ will use reasonable efforts to:

• acknowledge a sufficiently detailed report;

• investigate and prioritise based on risk;

• request further information where needed;

• limit unnecessary disclosure of the reporter's identity; and

• provide status information where practical.

Polo HQ does not operate a public bug-bounty programme and does not promise payment, credit, employment or any other reward. Any reward or public acknowledgement is entirely discretionary and must be agreed in writing.

5. Customer security responsibilities

Customers and Users must:

• use strong, unique passwords;

• keep devices and browsers reasonably secure and updated;

• protect activation, login and native-app handoff links;

• grant access only to authorised Users;

• remove access promptly when a User leaves or changes role;

• avoid sharing individual credentials;

• review suspicious activity and service notices; and

• report suspected compromise promptly.

6. Security incidents and personal data breaches

Polo HQ handles personal data incidents in accordance with applicable law and the Data Processing Addendum. Where required, Polo HQ will notify affected controllers, individuals or regulators within the applicable legal framework.

7. Intellectual property and confidentiality

Security testing does not grant a licence to copy, reproduce, benchmark or commercialise Polo HQ software, interfaces, documentation, schemas or confidential information.

Information obtained solely through vulnerability research must be used only for responsible reporting and remediation, subject to mandatory law.

8. Contact

POLO HQ LTD
Company number 17059471
43 Diamond Ridge, Camberley, England, GU15 4LB
info@polohq.com