Effective date: 26 September 2026
Last modified: 9 October 2026
Version: 1.1
Approver: EVCV Limited
Review date: 26 March 2027
Applies to: Premium Hosting-owned public systems expressly within scope
Company details: EVCV Limited, trading as Premium Hosting, company number 13570383, registered office 28 Oak Tree Lane, Cookhill, Alcester, Warwickshire, B49 5LH, United Kingdom.
VAT registration number: GB389265053. ICO registration number: ZB232228.
Introduction
We welcome good-faith reports that help protect customers and services. This policy defines responsible testing and reporting; it is not a bug-bounty programme and does not promise payment.
Section 1 — Reporting
1.0.1 Send suspected vulnerabilities to sales@premium-hosting.co.uk with “Security vulnerability” in the subject. This is the monitored security-reporting route at launch.
1.0.2 Include the affected URL/system, vulnerability type, reproducible steps, impact, evidence and safe contact details. Encrypt sensitive evidence using an approved method once provided.
Section 2 — In-scope conduct
2.0.1 Limit testing to the minimum needed to demonstrate the issue. Stop if you access personal data, customer content, credentials or non-public systems, and report immediately.
2.0.2 Do not use social engineering, phishing, physical intrusion, malware, denial of service, destructive testing, persistence, automated high-volume scanning or attacks on customers and suppliers.
2.0.3 Third-party platforms, including upstream infrastructure and payment services, are outside scope unless we expressly confirm otherwise. Use the provider’s own disclosure route.
Section 3 — Our response
3.0.1 We will acknowledge and triage reports without unnecessary delay, seek clarification where necessary and coordinate remediation and disclosure where appropriate.
3.0.2 We cannot provide unrestricted details about customers, security architecture or investigations.
Section 4 — Good-faith assurance
4.0.1 Where you comply with this policy, act lawfully and avoid harm, we do not intend to pursue legal action merely for the authorised good-faith research. This does not authorise conduct prohibited by law or by a third party.
4.0.2 You are responsible for obtaining any permission required for systems not owned by EVCV Limited.
Section 5 — Disclosure and rewards
5.0.1 Do not publicly disclose an unresolved issue or customer information. Coordinate timing with us, recognising that supplier remediation may be required.
5.0.2 We do not operate a paid bug-bounty programme. Submission does not create a right to payment, employment or public recognition.
Section 6 — Changes and privacy
6.0.1 We may update scope, contacts and process as systems change. Reporter information is handled under our Privacy Policy.