Security and responsible disclosure

At a level that is safe to publish, the safeguards built into Mandate SA are:

• Three separate applications — the public website, the editorial Desk and the account portal — so the public site never holds an editorial or account session.
• Access rules enforced inside the database for every role. The public website reads only published data through a role that cannot write or see anything unpublished.
• Two-step verification for every staff member and account holder, and sessions that end after inactivity and can be ended everywhere at once.
• Two-person publication: official data and editorial records are published only after review by someone other than the person who prepared them.
• Rate limits and automated-abuse checks on public forms; uploaded files are checked and kept in quarantine; contact details in submissions are sealed with a key kept offline.
• An append-only, tamper-evident record of security events and of every change to the published record.
• Automated tests that check these rules — database permissions, role boundaries and sign-in flows.

Mandate SA holds no security certification and has not had an independent security assessment. No system is perfectly secure.

If you believe you have found a security weakness in Mandate SA, please tell us privately: write to info@mandatesa.com with the subject line “Security report”, and at first describe only the affected page or feature, without exploit details; we will reply to arrange how to share the rest. Please do not raise it in public until it has been fixed.

A report we can act on usually includes:

• the page, address or feature affected;
• the steps to reproduce it, with the smallest possible example;
• what an attacker could do, as you understand it;
• how we can reach you.

• Use only your own accounts and test data. Do not access, change, copy or keep anyone else's information. If you reach other people's data by accident, stop, keep nothing, and tell us.
• Do not disrupt the service: no denial-of-service, load or volume testing, and no automated scanning that degrades the site.
• No social engineering of staff, physical attacks, or attacks on our service providers.
• Do not demand payment for a report.

We acknowledge receipt, assess the report, keep you informed of progress, and fix confirmed issues in order of severity. When an issue is fixed, we will agree with you on disclosure and credit you if you wish. We do not commit to fixed response times.

In scope are this website, the account portal and the published data endpoints of Mandate SA. Third-party services are out of scope; report issues with them to their owners. Mandate SA does not run a bug bounty programme and does not pay for reports.

We will not treat good-faith research that follows this page as hostile. We cannot, however, promise immunity from claims by others, or waive rights that are not ours to waive.