Security disclosure

If you believe you have found a security issue affecting 2100solutions.com or related authenticated areas we operate, we want to hear about it through a controlled channel. This page is informational—not a contract and not legal advice.

1. Scope

Reports we can action typically include:

• This public website and its forms.
• Customer, applicant, worker, and staff sign-in areas hosted on the same application, when you have lawful access to test.
• Issues that could expose personal data, accounts, or administrative functions without authorisation.

Out of scope: social engineering of staff or users, physical intrusion, denial-of-service against production systems, and testing third-party services (hosting, email, font CDNs, market-data APIs) except where misconfiguration on our site clearly causes harm.

2. How to report

1. Prefer the contact form with category Security report. Use a subject line that indicates security (for example “Security report — [brief topic]”).
2. Describe the issue, affected URLs or features, and steps to reproduce at a level sufficient for us to verify—avoid attaching exploit code unless necessary.
3. Include a way to reach you for follow-up questions.

Do not post exploit details, customer data, or credentials on public forums, social media, or issue trackers before we have had a reasonable opportunity to investigate.

A dedicated security mailbox or PGP key will be published here only after company management approves it for public use.

3. What we do not promise

• No bug bounty — we do not offer monetary rewards unless a separate programme is announced and approved.
• No safe-harbor terms on this page — coordinated disclosure expectations should not be interpreted as immunity from applicable law; counsel may publish formal policy later.
• No fixed timelines — we do not guarantee acknowledgement or remediation within specific days until operational standards are approved.

4. What you should avoid sending

• Passwords, private keys, seed phrases, or full payment instrument details.
• Large exports of personal data from our systems—stop once you have enough evidence to demonstrate the flaw.
• Requests to access accounts or environments you are not authorised to use.

5. Our practices (high level)

The application uses role-based access for staff and customers, encrypted storage for sensitive worker payout wallet fields, rate limiting on some public forms, and audit logging for important administrative actions. We do not publish detailed architecture diagrams, version matrices, or internal host names on this page because they do not help legitimate reporters and may aid attackers.

6. Privacy-related incidents

If your concern is about how personal data is handled rather than a technical vulnerability, use category Privacy request or read Privacy & complaints contact.