Vulnerability Disclosure Policy

Overview

RB Consultancy Ltd is committed to addressing and resolving security issues through a coordinated and constructive approach designed to provide the greatest protection for our customers, partners, staff and all internet users.

A security vulnerability is a weakness in our systems or services that may compromise security. This policy applies to security vulnerabilities discovered anywhere by both RB Consultancy Ltd staff and by third parties using our services.

Reporting a Vulnerability

If you believe you have discovered a vulnerability in one of our services, or have a security incident to report, please contact us by either of the methods below:

• Email: rb@rbconsultancyltd.co.uk
• Phone: +44 (0) 333 3390051

Please include enough detail about the vulnerability for us to investigate successfully, including the steps required to reproduce the issue.

Our Response Process

Once we have received a vulnerability report, RB Consultancy Ltd will take the following steps to address the issue:

• Provide prompt acknowledgement of receipt of your report
• Request that the reporter keep any communication regarding the vulnerability confidential
• Work to understand and investigate the vulnerability
• Provide a timeframe for addressing the vulnerability
• Notify the reporter once the vulnerability has been resolved, to allow retesting where needed
• Where appropriate, publicly acknowledge the vulnerability and the reporter (unless the reporter would prefer to remain anonymous)

RB Consultancy Ltd will endeavour to keep the reporter informed at every step of this process.

Guidance for Researchers

We greatly appreciate the efforts of security researchers who share information on security issues with us, giving us the opportunity to improve our services and better protect our customers.

In line with responsible disclosure good practice, we ask that researchers:

• Allow RB Consultancy Ltd a reasonable period to correct a vulnerability before publicly disclosing the issue
• Provide sufficient technical detail to allow us to investigate and reproduce the issue
• Use the Common Vulnerability Scoring System (CVSS) where possible when reporting a vulnerability

What is Prohibited

To protect our customers, partners and staff, the following activities are not authorised under this policy:

• Modifying or deleting data, or taking any action that would impact RB Consultancy Ltd customers
• Carrying out social engineering exercises against RB Consultancy Ltd staff, customers or partners
• Performing denial-of-service or resource-exhaustion attacks
• Accessing, downloading or retaining personal data belonging to others
• Publicly disclosing the vulnerability before we have had a reasonable opportunity to address it

Policy Ownership

Responsibility for this policy sits with the senior management team of RB Consultancy Ltd, who review it on at least an annual basis. All staff are required to follow this policy and receive regular training on its application.

Contact Us

If you have any questions about this Vulnerability Disclosure Policy, please contact us:

Address: 20-22 Wenlock Road, London, England, N1 7GU

Email: rb@rbconsultancyltd.co.uk

Effective Date: 09-Oct-2024

Last Updated: 25-Jun-2026