Reporting a security issue.

Last updated: 6 November 2026

Keeping our clients' systems and data safe matters to us; it's why we're certified to ISO/IEC 27001. If you believe you've found a security vulnerability in a website, portal, app or system run by PureNet, please tell us so we can fix it.

How to report it

Email security@purenet.co.uk with:

• the website, page or system affected;
• what the issue is, and the steps to reproduce it;
• what an attacker could do with it, as far as you know;
• how we can contact you.

Please don't include personal data you may have seen, beyond what's needed to show the issue.

If the issue affects a website or system we run for one of our clients, report it to us and we'll work with the client to fix it.

What we ask of you

• Give us a reasonable time to fix the issue before you tell anyone else about it.
• Only do what's needed to show the issue: don't access, change or delete data that isn't yours, and stop once you've confirmed it.
• Don't disrupt or degrade our services or anyone else's, and don't use social engineering, phishing or physical attacks.
• Don't use automated scanning that sends large volumes of requests.

What we'll do

• Acknowledge your report and keep you updated on our progress.
• Investigate it and, where it's confirmed, fix it, handling it as an information security incident under our ISO 27001 management system.
• Let you know when it's fixed and, if you'd like, credit you.

We don't run a paid bug bounty. We won't take legal action against anyone who reports an issue in good faith and follows the guidance on this page.

Other concerns

• Questions about your personal data: see our privacy policy or email privacy@purenet.co.uk.
• If you're a client and something is wrong with your service, raise it through your usual support channel.

See also: information security policy · all our certification and policies