ReceiptTrack

Security and Responsible Disclosure

How to report security concerns, what controls we operate, and how we triage and communicate incidents.

Last updated: 16 March 2026

Security and Responsible Disclosure

This page explains ReceiptTrack's security reporting channel, response workflow, and baseline security controls for customer and regulator visibility.

1. Scope of this security notice

This notice applies to the public website, customer dashboard, supporting APIs, and integrated workflows, including Making Tax Digital journeys where supported and authorised by users.

It is not a contractual security annex. Contractual commitments, where applicable, are governed by customer agreements and terms.

Security reporting route

Log in and open the Help section ticket system.

For urgent incidents affecting active customer data, include "Urgent Security Incident" in the subject and add the affected environment, date/time, and impact summary.

2. How to submit a vulnerability report

To help us triage quickly, include:

  • clear reproduction steps and expected versus observed behavior;
  • target URL, endpoint, account role, and environment affected;
  • timestamp and timezone of testing;
  • proof-of-concept details with no unnecessary customer data exposure.

3. Responsible disclosure expectations

We ask researchers to avoid privacy violations, service degradation, social engineering, and any activity that disrupts customer operations. Please do not publicly disclose vulnerabilities until remediation or mitigation has been coordinated with our team.

4. Security response process

  1. Intake and acknowledgement of report.
  2. Triage, severity assessment, and ownership assignment.
  3. Containment and mitigation planning where required.
  4. Fix deployment and verification testing.
  5. Post-incident review and control improvements.

Confirmed incidents are handled through internal escalation paths. Where legally required, regulators and affected parties are notified within statutory windows.

5. Baseline technical controls

  • Transport encryption and authenticated access controls.
  • Least-privilege access limitations for internal service operation.
  • Central logging, monitoring, and operational alerting.
  • Encryption-at-rest controls for sensitive token and integration data where configured.
  • Change-management and deployment controls across managed environments.

6. Making Tax Digital security context

Government Gateway passwords are not collected by ReceiptTrack. Where supported, authorisation for Making Tax Digital workflows is handled through secure connection flows.

Live connection and submission actions may remain disabled until ReceiptTrack completes the required approval steps.

7. Customer actions for account security

  • Protect account access and email security controls.
  • Review connected services and remove stale integrations.
  • Report suspicious account activity immediately.
  • Limit sharing of exported records and downloaded documents.

8. Security statement changes

We may update this security notice to reflect changes in controls, infrastructure, legal obligations, and incident-handling practice. Material updates will be published on this page.

Business Hub Pricing Product