Vulnerability Disclosure Policy

Version 4.0 | Last updated 9 October 2026

1. About this Policy

1.1 This Vulnerability Disclosure Policy (the "Policy") is issued by Earnly Limited (company number 16183799), registered office 41 New Cross Street, Swinton, Manchester, England, M27 4TU ("Earnly", "we", "us", "our").

1.2 Earnly helps sole traders, contractors, company directors and small businesses understand their finances using Open Banking Data. Keeping that data secure is central to what we do. We welcome reports from anyone who finds a security vulnerability in our systems, and we will work with you to understand and fix it.

1.3 This Policy explains what is in scope, how to report a vulnerability, what we will do and by when, the rules you must follow when testing, and the legal protection we give to people who follow them.

1.4 Capitalised terms used in this Policy have the meanings given in the "Definitions and interpretation" clause of the Terms and Conditions, including "Platform", "Account", "Connected Account", "Open Banking Data", "Provider" (meaning Finexer Ltd) and "Business Day" (Monday to Friday, excluding bank holidays in England and Wales).

2. Who this applies to

2.1 This Policy applies to anyone who looks for, finds or reports a security vulnerability in Earnly's systems, whether or not they hold an Account. This includes Consumers, Business Users (and individuals acting for an Organisation), independent security researchers and members of the public.

2.2 If you hold an Account, the Acceptable Use Policy also applies to you. Security testing that follows this Policy is permitted under the Acceptable Use Policy.

2.3 This Policy is not for general support, Account access problems or complaints. Please contact support@earnly.co.uk for support and complaints@earnly.co.uk for complaints.

3. Regulatory status

3.1 Earnly Limited (FRN 1058277) is registered on the Financial Services Register as an agent of Finexer Ltd, which is authorised and regulated by the Financial Conduct Authority under the Payment Services Regulations 2017 (Firm Reference Number 925695) for the provision of account information services. You can check this on the Financial Services Register at register.fca.org.uk. Earnly is not itself authorised by the Financial Conduct Authority. Earnly does not provide payment initiation services, cannot initiate payments or move money, and never receives, sees or stores your online banking credentials.

3.2 Because the Open Banking connection is provided through Finexer Ltd, Finexer's own systems are outside the scope of this Policy (see clause 4.2).

4. Scope

4.1 In scope. This Policy covers:

(a) the website at earnly.co.uk, including its legal pages and waitlist;

(b) the email sending domain notify.earnly.co.uk, including its email authentication configuration; and

(c) the Earnly web application (the Platform), which you reach by signing in from earnly.co.uk, including its sign-in, two-step verification, Account, company and personal profile, transaction, categorisation, receipt upload, tax estimate, CSV export and Settings → Integrations features.

4.2 Out of scope. This Policy does not cover, and gives you no permission to test:

(a) the systems of Finexer Ltd, including its hosted consent journey and application programming interfaces. Report any issue with Finexer's systems directly to Finexer Ltd through finexer.com;

(b) the systems of any bank or other account provider;

(c) the platforms of our hosting and infrastructure providers (listed on the Sub-processor List), HM Revenue & Customs or Companies House, except for a vulnerability that arises from Earnly's own configuration of them. Report vulnerabilities in those platforms themselves to the relevant provider;

(d) any domain, subdomain or service not listed in clause 4.1; and

(e) any mobile app claiming to be Earnly. Earnly does not currently have a native mobile app. Please report any such app to security@earnly.co.uk as suspected impersonation.

4.3 Findings we do not normally accept. We do not normally treat the following as vulnerabilities, unless you can show a realistic impact on the security of users or their data:

(a) reports from automated scanners that have not been validated;

(b) missing security headers, cookie flags or best-practice configuration with no demonstrated impact;

(d) self-cross-site scripting, or issues that require the victim to paste code into their own browser;

(e) software version or banner disclosure;

(f) missing rate limiting on actions that are not security-sensitive;

(g) email authentication (SPF, DKIM or DMARC) reports without a demonstrated ability to spoof email from an Earnly domain;

(h) issues that require physical access to, or prior compromise of, a user's device or email account; and

(i) issues that affect only browsers that are not current or previous major versions of Chrome, Edge, Firefox or Safari.

5. How to report a vulnerability

5.1 Email your report to security@earnly.co.uk. This address is also published in our security.txt file (see clause 12).

5.2 Please include:

(a) a description of the vulnerability and the type of issue;

(b) the affected domain, URL, page or feature;

(d) the impact you believe it has, and what an attacker could do with it;

(e) the email address of any test Account you used, the dates and times of your testing, and the IP addresses you tested from; and

(f) how you would like us to contact you, and whether you would like to be credited (see clause 11).

5.3 You must not include any other person's personal data or Open Banking Data in your report. If you came across such data, describe what you saw and where, but do not send it to us.

5.4 If you need to send sensitive technical information, say so in your first email and we will agree a secure way to receive it.

5.5 You may report anonymously. If you do, we will not be able to update you, credit you or confirm that the safe harbour in clause 8 applies to you.

5.6 Reports should be in English. Please do not report vulnerabilities through support@earnly.co.uk, social media or public forums.

6. What we will do

6.1 When you report a vulnerability in accordance with this Policy, we will:

(a) acknowledge your report within 2 Business Days;

(b) triage it within 5 Business Days of receipt, which means confirming whether we can reproduce it, assessing its severity and telling you what we plan to do;

(d) fix confirmed vulnerabilities within the remediation targets in clause 6.3; and

(e) tell you when the fix has been deployed.

6.2 Severity. We assess severity using the Common Vulnerability Scoring System (CVSS) base score as a guide, adjusted for the real-world impact on users and their data:

(a) critical: CVSS 9.0 to 10.0;

(b) high: CVSS 7.0 to 8.9;

(d) low: CVSS 0.1 to 3.9.

6.3 Remediation targets. Measured from the date we confirm the vulnerability at triage, we aim to fix:

(a) critical vulnerabilities within 14 days;

(b) high vulnerabilities within 30 days;

(d) low vulnerabilities as part of our normal development work.

6.4 These are targets. If a fix will take longer, for example because it depends on a third-party supplier, we will tell you why and agree a revised timetable with you.

6.5 If a vulnerability involves a personal data breach, we will handle it under our breach procedure, which includes telling the Provider within 24 hours where Open Banking Data is involved, notifying the Information Commission (ICO) within 72 hours where the breach is reportable, and telling affected individuals without undue delay where there is a high risk to them.

7. Rules of engagement

7.1 When looking for or testing a vulnerability, you must:

(a) test only against Accounts you have created yourself for testing, using email addresses you control, and only with data you have created. You may create up to two test Accounts to test whether one Account can access another's data;

(b) connect only bank accounts that you hold yourself, if your testing requires a Connected Account;

(c) stop testing immediately and report to us if you access, or could access, any data that does not belong to you, including any other user's personal data, financial data or Open Banking Data. You must not view more than is needed to confirm the issue, and you must not copy, download, keep, change or delete that data;

(d) use only the minimum testing needed to confirm the vulnerability, and keep automated requests to no more than 5 requests per second;

(e) keep the details of the vulnerability confidential until it may be disclosed under clause 9; and

(f) securely delete any data you obtained from Earnly's systems once your report is resolved, and in any event within 30 days after we tell you the fix has been deployed.

7.2 You must not:

(a) access, or attempt to access, any Account or data that is not yours;

(b) carry out any denial of service attack, load or stress testing, or any other activity that degrades, overloads or disrupts the Platform or the experience of other users;

(d) attempt to gain physical access to any premises or equipment;

(e) test, attack or attempt to access the systems of Finexer Ltd or any bank or account provider, including by interfering with the consent or authentication journey. Report any Finexer issue to Finexer Ltd directly;

(f) send email to anyone other than yourself through Earnly's systems, or use notify.earnly.co.uk to send unsolicited or spoofed messages;

(g) install backdoors, web shells or persistent access, or move from an affected system into any other system;

(h) use a vulnerability for any purpose other than confirming and reporting it, or tell anyone else about it before disclosure is permitted under clause 9;

(i) demand payment or any other benefit in exchange for reporting or not disclosing a vulnerability; or

(j) break any law.

7.3 If you are unsure whether something is allowed, ask us at security@earnly.co.uk before you do it.

8. Safe harbour

8.1 If you act in good faith and follow this Policy:

(a) we consider your security research to be authorised by Earnly, including for the purposes of the Computer Misuse Act 1990, in respect of the systems in scope under clause 4.1;

(b) we will not take legal action against you, or report you to law enforcement, in relation to that research;

(c) we will not take action against you or your Account under the Acceptable Use Policy or the Terms and Conditions in relation to that research; and

(d) if a third party takes legal action against you in relation to research that followed this Policy, we will make it known that your research was authorised by us under this Policy.

8.2 We can give authorisation only for systems that Earnly controls. We cannot authorise testing of the systems of Finexer Ltd, any bank, any hosting or infrastructure provider, HM Revenue & Customs, Companies House or any other third party.

8.3 The safe harbour does not apply to any conduct that breaches clause 7, to research carried out in bad faith, or to any demand for payment. It does not affect any legal obligation we have, including to report a personal data breach or to comply with a court order.

9. Coordinated disclosure

9.1 You must not disclose a vulnerability, or any details of it, to anyone other than Earnly until the earlier of:

(a) the date we tell you the fix has been deployed; and

(b) 90 days after the date you reported it to us,

unless we agree a different date with you in writing.

9.2 If we need more than 90 days to fix a vulnerability, we will explain why before that period ends and ask you to agree a later date. If a vulnerability is being actively exploited, we may agree an earlier date with you so that users can protect themselves.

9.3 Before you publish, please send us a copy of what you intend to publish at least 5 Business Days in advance, so that we can check that it does not put users at risk. We will not ask you to remove accurate technical content except to protect users. Any publication must not contain personal data, Open Banking Data or credentials.

9.4 We may publish our own advisory about a vulnerability and its fix, and, if you agree, we will credit you in it.

10. No bug bounty

10.1 Earnly does not run a bug bounty programme and does not pay rewards, fees or other compensation for vulnerability reports. By reporting a vulnerability, you agree that you are not entitled to any payment for it.

11. Recognition

11.1 If you wish, and if your report leads to a confirmed vulnerability being fixed, we will thank you by name or by a handle of your choice in a list of acknowledgements published at https://earnly.co.uk/legal/vulnerability-disclosure-policy. Recognition is optional, and we will not name you without your permission.

12. security.txt

12.1 We publish a security.txt file, in the format described in RFC 9116, at https://earnly.co.uk/.well-known/security.txt. It gives security@earnly.co.uk as the contact address and links to this Policy.

13. Your personal data

13.1 We use the personal data you give us in a report (such as your name, email address and IP addresses) only to handle your report, communicate with you, fix the vulnerability, give you recognition if you ask for it, and keep the Platform secure. We do this in reliance on our legitimate interests in keeping the Platform secure.

13.2 We keep vulnerability reports for the periods set out in the Data Retention Policy. The Privacy Policy explains your rights, which you can exercise by emailing privacy@earnly.co.uk. You can also complain to the Information Commission (ICO) at ico.org.uk or on 0303 123 1113.

14. Changes to this Policy

14.1 We may update this Policy from time to time, for example to change its scope or rules as the Platform develops. The version in force on the date you report a vulnerability applies to that report. If a change affects a report you have already made, we will apply whichever version is more favourable to you.

15. Governing law

15.1 This Policy is governed by the law of England and Wales.

16. Contact

Security reports: security@earnly.co.uk. General enquiries: support@earnly.co.uk. Post: Earnly Limited, 41 New Cross Street, Swinton, Manchester, England, M27 4TU.