Book a demoTry Templace
Home / Policies / Security

Cyber security and reporting a weakness

How we defend the Templace service against cyber attack, what we ask of its users, and how to report a security weakness to us responsibly.

Our approach

Cyber attack is the main threat to the information in the Templace service (the Service). This policy explains how we reduce that risk, and how anyone who finds a weakness can tell us about it. It sits alongside our Information security policy.

We plan for the attacks most likely to affect a service like ours, including:

  • phishing emails aimed at agency staff or at us, trying to steal passwords or redirect payments;
  • attempts to sign in with stolen or guessed passwords;
  • attacks on the web application, such as attempts to reach another agency's data;
  • harmful files uploaded as documents;
  • attacks on our suppliers, including our hosting provider;
  • automated spam sent through our website's contact form.

How we protect the Service

Our main controls are:

  • all traffic uses HTTPS, with TLS certificates issued automatically;
  • passwords are stored only as salted PBKDF2-HMAC-SHA-256 hashes;
  • sign-in sessions are held in a strictly necessary, HttpOnly cookie;
  • roles and permissions are set per user, and each agency's data is kept separate from every other agency's;
  • every change is recorded in an audit trail the agency can see;
  • Templace's own people enter an agency's system only by invitation or on reserved grounds, and every entry is recorded in the agency's audit trail;
  • each release passes our whole automated test suite, about 180 test suites, before it is installed, and the previous release is kept so it can be rolled back;
  • nightly backups, each checked for integrity and stored separately from the live database;
  • a hidden field and a rate limit on the website's contact form to turn away automated spam.

What we ask of agencies and users

Many attacks start with a person rather than a computer. Please:

  • use a strong password that you do not use anywhere else, and never share it;
  • be wary of unexpected emails asking you to sign in, open an attachment or change bank details;
  • keep your browser and device up to date;
  • remove accounts as soon as someone leaves your agency;
  • check your audit trail if something looks wrong;
  • tell us at once if you think an account or device has been compromised.

Reporting a weakness: what to send

If you think you have found a security weakness in templace.co.uk or the Service, please tell us. We welcome reports from anyone, including security researchers, agencies and their users.

Email terry@hilliernet.co.uk with Security in the subject line. Please do not report weaknesses on social media, and do not share details publicly until we have agreed that you can.

Do not send us personal data you may have seen. Describe it instead.

Please include:

  • a description of the weakness and what an attacker could do with it;
  • the web address, page or part of the Service affected;
  • step-by-step instructions to reproduce it, with any proof-of-concept code, requests or screenshots;
  • the date and time of your testing and the IP address you tested from, so that we can find your activity in our records;
  • how to contact you, and whether you would like to be named when the weakness is fixed.

Reporting a weakness: what happens next

Working days are Monday to Friday, except bank holidays in England and Wales. We do not offer payment for reports.

Please give us a reasonable time to fix the problem before you publish anything about it: normally 90 days from your report, unless we agree a different time with you.

If the weakness has put personal data at risk, we will also act under our Personal data breach and incident response policy, which may include telling the agencies affected.

We will:

  • acknowledge your report within 3 working days;
  • tell you within 10 working days whether we have confirmed the weakness, and what we plan to do;
  • keep you updated while we fix it, and tell you when it is fixed;
  • agree with you when details can be published, and name you if you want us to.

Rules for testing, and our promise to you

If you research our security in good faith and keep to the rules below, we will treat your research as authorised by us. We will not take legal action against you, or ask the police to act against you, because of it. If anyone else complains about research that kept to these rules, we will make it clear that it was authorised by us.

This promise covers only systems we run. We cannot give permission on behalf of anyone else, such as our suppliers or an agency's own systems.

You must:

  • test only against accounts you own, or that the account holder has allowed you to use;
  • stop as soon as you have shown the weakness, and go no further than you need to;
  • not access, change, delete or keep data that is not yours: if you see personal data or another agency's data, stop, tell us at once and delete any copy;
  • not disrupt the Service or affect other users, including through denial-of-service attacks or heavy automated scanning;
  • not use social engineering, phishing or physical methods against us, agencies, their staff, candidates or workers;
  • keep details of the weakness confidential until we agree they can be published;
  • not break any other law.

What is out of scope

If you find a weakness in a system that is not ours, please report it to the organisation that runs it. The following are out of scope:

  • systems we do not run, including our hosting provider's infrastructure, Anthropic's services, our mail provider, and agencies' own mail servers and websites hosted elsewhere;
  • denial-of-service or load testing;
  • social engineering, phishing or physical testing;
  • spam or rate-limit testing against the website's contact form;
  • output from automated scanners that does not show a real, exploitable weakness;
  • missing security headers, cookie settings or email settings such as SPF, DKIM or DMARC, without a demonstrated attack;
  • software version numbers or banner information on their own;
  • self-XSS, and clickjacking on pages with no sensitive action;
  • attacks that need a compromised device, an out-of-date browser or physical access to a user's device.

security.txt

Our contact details for security reports are also published in a security.txt file, served at /.well-known/security.txt on templace.co.uk, in the standard format set out in RFC 9116. It gives the address to send reports to and points to this policy, so that researchers and automated tools can find out how to reach us.

Security incidents

If we find, or are told about, a security incident, we act under our Personal data breach and incident response policy. Agencies and users should report a suspected incident to us straight away at terry@hilliernet.co.uk or on 07789 938284.

Cyber security and reporting a weakness · version 1.0 · approved 27/10/2026 · next review 27/10/2027. Templace is a trading name of TWH Holdings Limited, company number 10663539, Meadway, Mill Road, Writhlington, Radstock, BA3 5TY.