Version 2026-09-11 · 11 September 2026
Security
How to report a vulnerability and understand the service’s security boundaries.
Report a concern
Email michele.g@synapticacnsltg.com with subject “Demand Locator security”. Include the affected route, a concise description and steps that use your own test data. Do not send passwords, API keys, real customer exports or unnecessary personal information.
Do not access other people’s records, disrupt availability or continue exploitation after confirming an issue. We review reports and coordinate remediation. No bug-bounty payment or blanket authorisation to test third-party systems is implied.
Controls
The marketing service uses HTTPS, restrictive browser security headers, same-origin APIs, bounded JSON input, rate limits and a private operator workspace. Operators authenticate with a single-use link and TOTP; server-side sessions use HttpOnly cookies, inactivity expiry and revocation. Exports and deletion require recent verification.
Application security logs use a closed schema without request bodies, access tokens or email addresses. Administrative actions are recorded separately with keyed identifiers. New-request email alerts contain only a reference and a workspace link. Public analytics has no visitor ID.
Scope and assurance
These controls do not amount to a claim of certification, guaranteed availability, an independent penetration-test pass or completed legal compliance. Platform and organisational controls need ongoing review. We keep separate records for incident response, access reviews, backup restoration and security testing.
A discovered data breach is assessed for containment, affected people and any required notifications. The security contact is also the coordination point for privacy incidents. Please use the privacy page for ordinary data-rights requests.