How we protect information
- Encryption: EndExpiry is served only over HTTPS, and browsers are told never to use it any other way. Our database provider encrypts the information it stores.
- Each business sees only its own information. This is enforced by the database itself, not only by the app, and we test it regularly with automated checks that sign in as different people and try to reach information that is not theirs.
- The right access for each role: staff, store managers and head office see and do different things. Staff need a check-in at the store to add or change stock.
- Accounts: passwords are stored only in scrambled form by our sign-in provider. People given a temporary password must choose their own first.
- Records: stock and product changes are recorded with who made them and when, in records that cannot be edited.
- Less to lose: we keep only what the service needs. A location used to check in, or to confirm the store when logging stock, is never stored. Camera images stay on your device, apart from a photo of a printed date that could not be read, which is kept privately to improve how dates are read.
- Where it runs: our database and app run in Sydney, Australia, with providers that hold recognised security certifications. They are listed on our Service providers page.
Our Privacy Policy explains what information we hold and why.
Reporting a vulnerability
If you believe you have found a security problem in EndExpiry, please tell us at security@endexpiry.com. Please include:
- what the problem is, and where;
- the steps to reproduce it; and
- how we can contact you.
We will acknowledge your report within 5 business days, keep you informed while we fix it, and let you know when it is fixed.
Please
- only test with your own account, or one you are allowed to use;
- stop as soon as you reach information that is not yours, do not keep or share it, and tell us what you saw;
- not overload the service, send spam, attempt to trick our people, or test anything physical; and
- give us a reasonable time to fix the problem before telling anyone else.
If you follow these guidelines and act in good faith, we will not take legal action against you for your research, and we will work with you to understand and fix the problem.
We do not currently pay rewards for reports, but we are grateful for them.