Vulnerability Disclosure Policy

Last updated: 2 November 2026

Purpose

Tembo welcomes reports of security vulnerabilities in our products, and will not pursue legal action against researchers who act in good faith and follow this policy.

This policy covers Tembo Money Limited (company number 12631312, FCA firm reference 952652) and Tembo Savings Limited (company number 12008146, FCA firm references 928010 and 913654), together “Tembo”.

We do not run a paid bug bounty programme and do not offer financial rewards. What we do offer is a clear process, a response within a stated time, and public credit once an issue is fixed.

Scope

These are the systems this policy applies to.

www.tembomoney.com — marketing site, calculators and guides. In scope.
appui.tembomoney.com — mortgage customer application and login. In scope.
Tembo iOS app — published on the App Store. In scope.
Tembo Android app — published on Google Play. In scope.
help.tembomoney.com — help centre hosted by Intercom. Report to the provider.
Supplier systems — the providers named in our Privacy Policy. Report to the provider.

Anything not listed above is out of scope. That includes our corporate IT, staff accounts and devices, and any domain or subdomain not named here.

We do not authorise social engineering of Tembo staff, customers or suppliers, and we do not authorise physical access attempts at any Tembo or supplier premises.

How to report

Email security@tembomoney.com. This is the only route we monitor for security reports.

Please do not send vulnerability reports to hello@tembomoney.com, savings@tembomoney.com or our in-app chat. Those are customer service channels, and a report sent there will be slower to reach the right people.

If your report needs to include sensitive material, email us first and we will arrange a secure channel for it.

This policy and the reporting address are also published in our security.txt file, at https://www.tembomoney.com/.well-known/security.txt

If your report concerns a potential data breach affecting our customers, please say so in the subject line so we can prioritise it.

What to include

A report we can reproduce gets fixed faster than one we have to investigate blind. Please include:

The URL, endpoint or app screen affected
The type of issue, and what an attacker could do with it
Step-by-step instructions to reproduce it
The account or test data you used, and the approximate date and time you tested
Any screenshots, request and response logs, or proof-of-concept code
Whether you believe any real customer data was exposed, and if so what you saw

Please write in English. If you used an automated tool, tell us which one and include the raw output rather than only the tool’s summary.

What we commit to

Acknowledgement — within 2 working days of receipt.
Initial assessment — within 10 working days, including whether we accept the finding.
Progress updates — at least every 30 days while the issue remains open.
Remediation — prioritised by severity. We will tell you our target date once assessed.
Closure — we confirm when the fix is live and agree any public credit with you.

We will treat your report confidentially and will not share your identity outside Tembo without your permission, unless we are legally required to.

We will not pursue legal action against you, or ask anyone else to, in respect of research carried out in good faith under this policy. We consider such research to be authorised access for the purposes of the Computer Misuse Act 1990. This does not extend to activity outside the boundaries set out below, and we cannot bind third parties or law enforcement.

What we ask of you

We are a regulated financial services firm and our systems hold customer identity, financial and special category data. The boundaries below exist to protect our customers.

Use only accounts you own or have explicit permission to test. Do not access, modify, download or retain data belonging to anyone else.
If you do encounter customer data, stop, do not save a copy, and tell us what you saw in your report.
Do not degrade our service. No denial of service, no load or stress testing, no automated scanning that generates significant traffic.
Do not use social engineering, phishing or physical intrusion against our staff, customers or suppliers.
Do not make changes that persist, such as creating content other users will see, or leaving test data in place.
Give us a reasonable opportunity to fix the issue before telling anyone else about it. We ask for 90 days from your report, and we will usually agree a shorter timeline for a straightforward fix.
Do not demand payment in exchange for the details of a vulnerability, or make disclosure conditional on a reward. We treat that as extortion rather than research, and this policy does not apply to it.

If you are unsure whether something is permitted, email us at security@tembomoney.com and ask before you test it.

Findings we do not accept

We will close the following without further action. Reporting them repeatedly may mean we stop responding.

Missing security headers with no demonstrated exploit, such as CSP, HSTS or X-Frame-Options
SPF, DKIM or DMARC configuration without a working spoofing proof of concept
TLS configuration findings, weak ciphers or certificate issues with no practical attack
Output from an automated scanner submitted without validation or a proof of concept
Missing rate limiting or account lockout, unless you can show real impact
Self-XSS, or issues requiring the victim to paste code into their own console
Clickjacking on pages with no sensitive action
Version disclosure, directory listing or verbose error messages with no exploitable consequence
Issues requiring a rooted, jailbroken or physically compromised device
Issues requiring an outdated browser or operating system that is no longer vendor-supported
Vulnerabilities in third-party services we do not control. Report these to the provider.
Social engineering, phishing, or reports about our staff rather than our systems
Theoretical findings with no demonstrated path to impact

If you believe one of these does have real impact in our specific context, show us the impact and we will assess it on that basis.

Recognition

We do not pay for vulnerability reports and do not operate a bug bounty programme. We offer public credit instead.

With your permission, we will add your name or handle to our acknowledgements page once an issue is resolved. You can choose to stay anonymous, and you can ask to be removed at any time.

To be listed, a report must:

Be a valid security issue affecting an asset listed as in scope
Be the first report we have received of that issue
Include enough detail for us to reproduce it
Have been handled in line with this policy, including the disclosure timeline
Have been remediated, or accepted by us as a risk we are managing

We decide what qualifies, and our decision is final. We will not list reports that fall into the findings we do not accept, and being listed is not a certification, endorsement or recommendation of any person or company.