Security & Responsible Disclosure

This notice forms part of the Privacy Policy.

Our commitment

Every page and every call to the service runs over an encrypted connection. Passwords are never stored in readable form; two-factor authentication with an authenticator app is available to every user and required for our operators. Accounts are verified before activation, repeated wrong passwords pause and then lock an account, each account is signed in on one device at a time by default, and sessions expire. The Spaces and the signed-in pages are protected against copying and automated use. Our operators work in a separate console with access limited to their role and fully logged. The service is monitored, kept up to date, and backed up regularly. We do not publish the details of these measures.

Responsible disclosure

If you find a vulnerability in Tile Stage, please tell us before anyone else: — (subject "Security"). Describe the issue, the steps to reproduce it and its impact. We acknowledge within 2 working days, keep you informed, and aim to fix confirmed issues within 90 days; we credit researchers who wish to be named.

Good-faith research is welcome within these rules: no denial-of-service or load testing; no automated scanning of the signed-in pages; do not access, change or delete data that is not yours and stop as soon as you can demonstrate the issue; do not use social engineering, phishing or physical attacks; do not make a finding public before we have fixed it or 90 days have passed. Research that follows these rules will not be treated as a breach of our Terms or as grounds for legal action by us. We do not currently run a paid bug-bounty programme.

Reporting account misuse

If your account was suspended, you see a sign-in you do not recognise, or you suspect your credentials are known to someone else, write to — at once.