Security and Responsible Disclosure Policy

Reasoned Limited | Company No. 16859259 128 City Road, London EC1V 2NX, United Kingdom

team@reasonedfinance.com | https://reasonedfinance.com

Version 1.0 · Last updated: 27 September 2026

This policy describes the security measures we use on Reasoned, and how to report a vulnerability. It covers reasonedfinance.com and the Learn, Compete and Get Hired apps, including accounts and payments handled for those products.

The same reporting rules are in clause 36 of the Platform Terms of Service. If this page and that clause differ, that clause prevails.

---

1. Measures we use

1.1 We use the following measures. This list is what the service does today. It is not a certification.

• Encryption in transit. The public site is served over TLS.
• Hashed passwords. Account passwords are stored as one-way hashes. We do not store the password you type.
• Session cookies. Sign-in sessions use cookies that are HttpOnly and SameSite=Lax. On the live site those cookies are also Secure.
• Card payments. Card payments are taken by Stripe. We store Stripe customer and subscription identifiers. We do not store the full card number.
• Hosting and access. The service is hosted in the EEA. Access to production systems and to personal data is limited to people who need it for their role.
• Staff permissions. Staff tools use role-based permissions.
• Logging. We log sign-in and security events, including the IP address and user agent. We do not publish a fixed retention period for those logs.
• Abuse controls. We apply rate limits and may block traffic that appears automated or abusive, as described in the Acceptable Use Policy.

1.2 Sign-in is by email and password, or by Google. We do not offer an authenticator-app or other second factor in the product.

1.3 No system is completely secure. We will notify the Information Commissioner's Office, and you where the risk to you is high, without undue delay in the event of a personal data breach, as required by UK GDPR and as described in the Privacy Policy.

---

2. How to report a vulnerability

2.1 Report a suspected vulnerability to team@reasonedfinance.com. Include enough detail for us to reproduce it: the URL or feature, the steps, and the impact you saw. Do not include other people's personal data in the report if you can avoid it.

2.2 Please give us reasonable time to fix the issue before telling anyone else.

2.3 Do not access, change or delete other people's data. Do not run tests that degrade the service, including denial of service. Do not send phishing or social-engineering attacks to our staff or users. Do not test systems that we do not operate.

2.4 We acknowledge reports within 2 working days. We do not promise a fix date. If you ask to be told, we will tell you when the issue is fixed, unless we are unable to.

2.5 If you follow this section, we will not treat your research as a breach of the Acceptable Use Policy and we will not pursue you for it.

2.6 We do not currently pay bounties.

2.7 You must not otherwise test, probe or attack the platform.