Security

Vulnerability disclosure policy

Last updated November 2026

We want to hear about security problems in CompanionAxis. If you think you have found one, tell us and give us a fair chance to fix it before you tell anyone else. We won’t take legal action against you for research that follows this policy.

How to report

Email [email protected]. Include what you found, where, the steps to reproduce it and what an attacker could do with it. Screenshots or a short video help. Our machine-readable contact details are in /.well-known/security.txt.

What we’ll do

Confirm we received your report within 3 business days.
Tell you within 10 business days whether we can reproduce it and how serious we think it is.
Keep you updated until it’s fixed, and tell you when it is.
Credit you on this page if you want us to, once the fix is out.

In scope

The CompanionAxis web app, its API and the platform console.
The CompanionAxis worker, admin and family apps for iOS and Android.
This website.

Please don’t

Access, change or delete data that isn’t yours. Use a trial account and stop as soon as you can show the problem.
Look at, keep or share personal or health information. If you see any by accident, stop, delete your copy and tell us.
Run denial-of-service tests, spam, social engineering or physical attacks against our staff, customers or offices.
Use automated scanners that send large amounts of traffic.
Publish details before we have fixed the problem, or 90 days after your report, whichever is sooner, unless we agree otherwise.

Not in scope

Reports from automated tools with no proof that the issue can be exploited.
Missing security headers or cookie flags that don’t lead to a real attack.
Problems in third-party services we use, which should go to that provider. Tell us too if it affects our customers.

CompanionAxis holds information about NDIS participants and their care. Our customers are told about any breach that affects them under the Notifiable Data Breaches scheme. See also our trust centre.