Legal

Cyber Security & Responsible Disclosure

Version 1.1 · Last updated: 22 October 2026

How ColdMatch Group protects the platform and the information users entrust to it, what we have verified, and how to report a security issue. Customer, supplier, RFQ and project information is treated as confidential (see the Privacy Policy).

1. Security controls (checked 22 October 2026)

Encryption in transit: the website is served only over HTTPS with TLS 1.2 or TLS 1.3; older TLS versions are refused, HTTP is redirected to HTTPS and HSTS is enabled.
Access control: database access rules restrict CRM records, private project rooms, transaction requests and their files to the signed-in owner, invited project members or authorised ColdMatch team members. Signed-out visitors have no read access. Team access requires a personal sign-in and is limited by role; destructive actions are restricted to the account owner.
Buyer contact details: hidden from supplier accounts until the ColdMatch team releases an introduction.
Private files: uploads are kept in private storage that cannot be listed publicly and are opened only through links that expire within minutes.
Upload checks: before storage, files are checked against an allowed list of file types and for executable content, and suspicious files are held separately. An external antivirus lookup is not enabled at present.
Search engines: private areas send a "noindex" instruction and are excluded from the sitemap.
Logging and backups: key CRM actions are recorded in audit logs, and our own backup archives are encrypted with AES-256.
Network: the website is delivered through Cloudflare; the on-site assistant has a basic request limit per connection.

Platform data is stored with our hosting and database provider. We have not independently verified that provider's encryption at rest for this platform and therefore make no specific claim about it. No system is completely secure, and we cannot guarantee that unauthorised access or data loss will never occur.

2. User responsibilities

Use a strong, unique password (or Google sign-in), keep sign-in links private and notify us immediately at security@coldmatchgroup.com if you suspect unauthorised access to your account.

3. Responsible disclosure

If you believe you have found a security vulnerability, please report it to security@coldmatchgroup.com with a description, reproduction steps and any relevant evidence. We ask researchers to:

Give us reasonable time to investigate and remediate before public disclosure.
Avoid privacy violations, service disruption and data exfiltration beyond what is strictly necessary to demonstrate the issue.
Not access, modify or delete data belonging to other users.
Comply with all applicable laws.

4. Safe harbour

We will not pursue legal action against researchers who report vulnerabilities in good faith and in accordance with this policy.

5. Out of scope

Denial-of-service testing, social engineering of employees or suppliers, physical attacks, and issues affecting outdated browsers or unsupported third-party services are out of scope.