Security Testing and Disclosure Policy

1. Purpose

usecure protects its customers' data and the platforms it runs on. This policy explains:

  • what security testing of usecure systems is allowed;
  • how to ask for approval to test; and
  • how to tell us about a security issue.

2. No testing without prior written approval

You must not carry out any security testing of usecure systems unless usecure has approved it in writing beforehand. This includes:

  • vulnerability scanning, automated or manual;
  • penetration testing;
  • fuzzing, brute-forcing or credential testing;
  • attempts to bypass authentication, authorisation or rate limits;
  • attempts to access data that isn't yours;
  • denial-of-service or load testing;
  • social engineering of usecure staff, customers or users; and
  • physical testing of usecure premises.

"usecure systems" means any website, application, API, mail service or infrastructure run by or for usecure Limited. That includes usecure.io and its subdomains, the usecure platform, and the domains we use to deliver phishing simulations.

Testing without approval isn't authorised. It doesn't matter whether you meant well, whether you found anything, or whether you report it to us afterwards. We may:

  • block the traffic involved;
  • report it to the network or hosting provider it came from; and
  • take any other action available to us, including under the Computer Misuse Act 1990.

3. Customers who want to test

Some customers, and their auditors, need to test the services they buy. If you're a usecure customer, you can ask for approval by emailing security@usecure.io with:

  • your company name and usecure account;
  • the name and company of the tester, and their certification (for example CREST or CHECK);
  • what you want to test, and which accounts or environments;
  • the testing method and tools;
  • the proposed dates and times; and
  • the source IP addresses the testing will come from.

We'll reply within 5 business days and give a decision within 10 business days. If we approve, we'll confirm the scope, dates and conditions in writing. Testing must stay within that approval. Testing must use only your own account and data, and never another customer's.

Approval covers only systems usecure operates. It doesn't cover third-party services we use, such as our hosting, email or support providers, which have their own policies.

The tester must:

  • share any vulnerabilities found with usecure within 5 business days of the test ending;
  • keep the findings confidential; and
  • not carry out denial-of-service or load testing unless the approval says so.

This policy doesn't change any audit rights under our Data Processing Agreement. Penetration testing needs approval under this section.

We may refuse a request, or suggest our latest independent penetration test summary or certifications instead, which are available through our Trust Centre.

Running phishing simulations and training through the platform, as the service is designed to be used, isn't security testing and doesn't need approval.

4. Reporting an issue you've come across

If you come across what you think is a security issue in a usecure system without testing for it, email security@usecure.io. Please include:

  • what you found and where;
  • clear steps to reproduce it; and
  • what an attacker could actually do with it.

Then stop. Don't investigate further, and don't access or keep any data. Reporting an issue doesn't authorise any testing.

Please don't include passwords, personal data or other sensitive information in your first email. If you need to send it, tell us and we'll arrange a secure way to share it.

If you saw or accessed any personal data, describe what kind it was (for example, names and email addresses of learners) without including the data itself. Then delete it and keep no copies.

Don't tell anyone else about the issue until we've fixed it, or for 90 days from your report, whichever is sooner, unless we agree otherwise.

If you come across an issue by accident and report it promptly in line with this section, without asking for payment, we won't take legal action against you for that discovery or your report. This doesn't apply to testing under section 2.

We aim to acknowledge reports that meet this section within 5 business days. We'll review reports that include steps to reproduce and a realistic impact. We may not reply to reports that don't.

5. What we don't treat as a vulnerability

We don't respond to reports that only cover the following, unless they come with a working demonstration of real impact:

  • missing or misconfigured HTTP security headers;
  • SPF, DKIM or DMARC settings;
  • clickjacking on pages with no sensitive actions;
  • software version or banner disclosure;
  • TLS configuration, such as supported cipher suites or protocol versions;
  • missing rate limiting or CAPTCHA on public forms;
  • CSRF on logout or other actions that don't change anything;
  • self-XSS, or issues that need physical access to a user's device;
  • reports generated by automated scanners or AI tools without manual verification; and
  • anything about the domains, emails or landing pages we use for phishing simulations. They're designed to look like phishing.

6. No bug bounty

usecure doesn't run a bug bounty programme and doesn't pay for vulnerability reports. Reports that ask for payment as a condition of disclosure will be treated as unsolicited and may go unanswered.

7. Contact

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.security@usecure.io

usecure may update this policy at any time. The current version is always on this page.

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.Version 1.0, effective 5 November 2026