Security
Responsible disclosure — how to report a vulnerability.
Halo Connected Health processes special-category health data on behalf of care providers, NHS trusts and families. Security research that helps us protect that data is welcomed, appreciated, and acknowledged. This page tells you how to report a suspected vulnerability, what response you can expect, and where the safe-harbour boundaries sit.
How to report
Send encrypted email to security@haloconnectedhealth.com, encrypted with our PGP key. If you cannot use PGP, send the report over plain email and we will move to an encrypted channel on the first reply.
1. Encrypt
Download our PGP public key from haloconnectedhealth.com/security.pgp. Import it into your PGP tool, then encrypt your report to key ID 0xHALO-CH-SECURITY. Fingerprint published on the key file itself.
2. Include
- Affected component + URL
- Steps to reproduce
- Impact assessment
- Your PGP fingerprint for reply
- Preferred credit name (or anonymous)
3. Send
security@haloconnectedhealth.com
We monitor this mailbox 24/7. First acknowledgement is automated and immediate; substantive triage reply within 48 hours on working days.
Response SLA
These are commitments, not aspirations. If we miss them, we tell you why.
| Milestone | Timeframe from receipt | What you get |
|---|---|---|
| Acknowledgement | Immediate (automated) | Confirmation that your encrypted message decrypted, and a case reference. |
| Triage reply | Within 48h (working days) | Severity assessment, whether we can reproduce, and expected disclosure timeline. |
| Fix rolled to staging | Critical: 7 days High: 14 days Medium: 30 days Low: 90 days | Confirmation and a test build for you to verify (if applicable). |
| Fix rolled to production | Same-day to +5 days after staging | Deployment notification and post-deployment verification. |
| Coordinated public disclosure | 30 days after production fix (default) | Joint disclosure text agreed with you. Credit given per your preference. |
Scope
In scope
haloconnectedhealth.comand all subdomainsapp.haloconnectedhealth.com(the Halo platform)api.haloconnectedhealth.comand staging/testing variants- Halo iOS and Android mobile apps
- Halo webhook receivers and MQTT ingress endpoints
- Authentication flows (Firebase Authentication + backend JWT verification)
- Any cryptographic implementation (envelope encryption, HMAC verification, TLS termination)
Out of scope
- Denial-of-service testing against production
- Social-engineering attacks on Halo staff, customers, or their families
- Physical attacks against Halo offices or data centres
- Compromise of a customer’s own AWS, IdP, or device-manufacturer account
- Third-party services we integrate with (report those directly to the third party)
- Findings requiring physical access to a resident’s device
- Missing security headers with no demonstrable exploit path
Safe harbour
If your security research is conducted in good faith and in accordance with this policy, Halo Connected Health (a product of DXN Design Ltd, Companies House NI684155) will:
- Not initiate or support legal action against you for the research.
- Work with you to understand and validate the issue, then remediate it.
- Recognise your contribution publicly if you want the credit, or keep you anonymous if you don’t.
- Agree a coordinated disclosure timeline with you before publishing anything.
Good faith means: you don’t intentionally access, modify or destroy data belonging to other people; you stop testing and report the issue as soon as you understand its severity; you don’t publicly disclose the issue before we agree a coordinated timeline; you don’t attempt to extract more data than is minimally necessary to demonstrate the vulnerability; and you comply with UK law and the law of any jurisdiction from which you’re testing.
This safe-harbour statement does not, and cannot, override statutory obligations we have to regulators (ICO, MHRA) in the event that your finding constitutes a personal-data breach or clinical-safety hazard. Where such obligations apply, we will notify the relevant regulator on the timeline they require. That notification will not identify you.
PGP public key
Encrypt all reports with this key. Fingerprint verification is inside the key file — verify it before use.
Download: haloconnectedhealth.com/security.pgp
Also available via well-known: /.well-known/security.txt (RFC 9116)
Import: curl -s https://haloconnectedhealth.com/security.pgp | gpg --import
Verify fingerprint: gpg --fingerprint security@haloconnectedhealth.com
Security architecture
Full detail on how we protect data is in the compliance section. Highlights below.
Encryption
TLS 1.3 in transit. HSTS preload. AES-256 at rest for structured data, envelope encryption via AWS KMS with per-tenant CMKs.
Access
Role-based + attribute-based scoping. MFA enforced for every user with access to resident data. Break-glass access logged and reviewed weekly.
Audit
Every read and write of resident data logged with actor, action, timestamp, IP. Immutable append-only log in S3 Object Lock. 8-year retention.
Full ISO 27001 posture → · NHS DSPT position → · UK GDPR handling →