Report a security problem
If you have found a weakness in Holder, please tell us. We would much rather hear it from you first. This page says how to reach us, what we will do, and what is and is not covered.
Last updated 6 October 2026
How to tell us
Email security@holder.cloud. Say what you found, where you found it, and the steps to make it happen again. Screenshots and short notes are plenty.
Holder looks after health and wellbeing records, so please do not put real client information in your report. If you came across some by accident, stop there, tell us what kind of information it was and where, and do not keep a copy.
The same contact is published for security tools at /.well-known/security.txt.
What we will do
We will reply to say we have your report within 5 working days.
We will tell you what we find, keep you up to date while we fix it, and let you know when it is done. If you would like to be thanked by name once it is fixed, say so and we will.
We do not run a bounty scheme and cannot offer payment for reports.
What is covered
holder.cloud, and the addresses practices use on it, which look like practice-name.holder.cloud.
Holder as a service: the website, the sign-in, the booking pages, the practitioner app and our own API.
What is not covered
- •Anything that makes Holder slow or unavailable for others, such as denial-of-service attacks.
- •Tricking people, such as phishing or other social engineering aimed at Holder, its staff, practices or their clients.
- •Automated scanning that sends more than 5 requests a second.
- •Other customers' data. Please test only with a practice account you have made yourself. If a weakness lets you see someone else's information, stop once you have shown that it can be done. Do not open, change, copy or share it.
- •Physical access to people, offices or devices.
- •Services we use but do not run, such as our hosting, payment or email providers. Please report those to the company concerned.
Safe harbour
If you look for a problem and tell us about it in good faith, following this page, we will not take legal action against you, and we will not ask anyone else to. If someone else does, we will say that you were acting under this policy.
Good faith means you stay inside what is covered, use accounts of your own, stop as soon as you have shown the problem, leave other people's data alone, and give us a reasonable time to fix it before you share the details with anyone else.
This page is our promise about how Holder will behave. It cannot speak for anyone else, and it does not allow anything the law forbids.