Keeping your venue’s data safe matters to us. If you think you’ve found a security problem in PubSuite, or that someone has seen data they shouldn’t have, please tell us straight away.
Report a security problem
Email hello@pubsuite.app with “Security report” in the subject. Please include:
- what you found and where (the page address, if you have it)
- the steps that show the problem
- how we can contact you
We’ll reply within two working days, keep you updated while we fix it, and tell you when it’s done. Reports are read by a person, not filed automatically.
When looking into a problem, please only use your own account or a test account, don’t view, change or keep other people’s data, and give us a reasonable time to fix it before telling anyone else. If you do that in good faith, we won’t take action against you.
The same contact details are published in machine-readable form at /.well-known/security.txt on every PubSuite address, for example https://platform.pubsuite.app/.well-known/security.txt.
If you’re a venue and something looks wrong
If a staff login may have been used by someone else, deactivate it straight away (Staff → the person → Deactivate) and email us. If anything in your HMRC VAT records looks unfamiliar, the owner can disconnect PubSuite from HMRC in Office → Accountant → VAT → Making Tax Digital, and should email us at once.
How we protect your data
- Every connection uses HTTPS (TLS 1.2 or 1.3).
- Data is encrypted at rest by our hosting provider, and backups are encrypted (AES-256) before they leave the server.
- Each venue’s data is kept separate, and staff only see what their role allows.
- Passwords are never stored, only salted hashes of them. We never see or store your HMRC sign-in details: you sign in on HMRC’s own page.
- Only a venue’s owner can connect to HMRC or send a VAT return, and only after entering a one-time code sent to their email.
- The software is security-tested before every release, and we run penetration tests every quarter.
- A venue’s owner can download all of the venue’s data at any time from Settings → Your data.
If there is ever a breach involving your data, we’ll tell you without delay, and we’ll tell the Information Commissioner’s Office and HMRC where the law and HMRC’s rules require it. More detail is in our privacy policy.
