Security & responsible disclosure

Last reviewed: 27 September 2026

We take the security of our platform seriously and welcome reports from security researchers acting in good faith.

How we protect the platform

• HTTPS, HSTS and modern TLS are enforced throughout.
• Administrative access requires strong authentication and least privilege.
• Dependencies are scanned and patched on an ongoing basis.
• Independent penetration testing is conducted before launch and after material change.

Reporting a vulnerability

Please use the form linked below, or email security@hospitalwayfinder.co.uk. Include enough detail to reproduce the issue. Please do not access, modify or exfiltrate data beyond what is needed to demonstrate the issue, and do not use real patient data in your report.

We aim to acknowledge reports quickly and will keep you updated as we investigate.