Security and Responsible Disclosure

Connections to our website, client area, control panel and email use encryption (HTTPS and TLS).

Staff systems require two-step sign-in, and access is limited to people who need it.

Our servers are kept updated, monitored around the clock, protected by firewalls and intrusion blocking, and scanned for malware on shared hosting.

Card numbers are handled by Stripe and never stored by us. Passwords are stored hashed. Server passwords we create are shown to you once and then deleted.

Use strong, unique passwords and turn on two-step sign-in for your account.

Keep your websites, plugins and server software up to date.

Tell us straight away if you think your account has been compromised.

Email hello@pricehq.tech with "Security" in the subject. Include what you found, where, how to reproduce it and the impact you think it has.

We'll acknowledge your report within 2 business days, keep you updated, and tell you when it's fixed.

In scope: pricehq.tech, my.pricehq.tech, mail.pricehq.tech, and our hosting and VPS platforms.

Out of scope: customers' own websites and servers (report those to the customer or through our Abuse Reporting process), social engineering of our staff, physical attacks, denial-of-service testing, and reports from automated scanners without a demonstrated impact.

If you act in good faith, follow this policy, avoid harming people or our services, don't access, change or keep other people's data beyond what's needed to show the problem, and give us reasonable time to fix it before telling others, we won't take legal action against you or ask others to.

We don't currently run a paid bug bounty, but we're grateful for responsible reports and happy to credit you if you'd like.