Security Disclosure Policy

Email hello@oxyaccounting.co.za with "Security" in the subject line. Please include:

• What the weakness is and what someone could do with it
• The page, address or feature it affects
• The steps to reproduce it, written so that someone else can follow them
• The date and time you found it, and the email address of any account you used

Plain text is fine. A short report with clear steps is more useful to us than a long one generated by a scanner.

We do not authorise security testing of the live service. That includes free trial accounts you open yourself, because every account runs on the same platform as our customers' books, payroll and VAT records.

In particular, please do not:

• Run automated scanners, fuzzers or brute-force tools against oxyaccounting.co.za or app.oxyaccounting.co.za
• Try to reach, change or delete any information that is not yours
• Put load on the platform, or try to make it unavailable
• Send email, invoices or other documents to anyone through OxyAccounting to test it
• Try to trick our staff or our customers into giving you access

If you come across a weakness while using OxyAccounting in the ordinary way, stop there and tell us. Do not go further to see how far it reaches.

• Access or keep no more information than you need to show us the problem, and delete anything you did see once you have reported it
• Keep the details to yourself until we have fixed it, or until we have agreed a date with you
• Give us reasonable time to fix it. We are a small team and will tell you how long we expect it to take

We will not take legal action against, or report to the authorities, anyone who reports a weakness in good faith and keeps to this policy.

• We aim to acknowledge your report within five working days
• We will tell you whether we can reproduce it and what we intend to do about it
• We will let you know when it is fixed

If a weakness has put a customer's personal information at risk, we will deal with it as the Protection of Personal Information Act requires, which may mean telling the Information Regulator and the people affected.

We do not run a bug bounty and we do not pay for reports, whatever their severity. We are grateful for every genuine report all the same, and we will thank you for it.

We do not respond to requests for payment in return for the details of a weakness.

These are worth knowing about, but on their own they are not a weakness someone can use against our customers:

• Output from an automated scanner with no demonstrated way to exploit it
• Missing or differently configured security headers, unless you can show the harm
• SPF, DKIM or DMARC settings on our email domain
• Clickjacking on a page with nothing sensitive to click
• Cross-site request forgery on logging out or on a public contact form
• Software version numbers being visible
• Problems that only affect an out-of-date browser

OxyAccounting (Pty) Ltd, registration number 2026/615785/07. Security reports go to hello@oxyaccounting.co.za with "Security" in the subject line. Section 9 of our Acceptable Use Policy says the same and applies to everyone who uses OxyAccounting.