Skip to main content
RobinReturn
Start free first reminder on us
Security

What protects
the work.

The marketing surface has no PII and no auth. The SaaS at app.robinreturn.co.uk does, and it is the same regulated boundary your invoice and debtor data lives behind.

Transport & browser

Encrypted, isolated, locked down.

I
HTTPS everywhere
Every request to www.robinreturn.co.uk and app.robinreturn.co.uk is encrypted with TLS 1.2 or higher. Plain-HTTP requests are 301-redirected to HTTPS at the edge.
II
HSTS preloaded
The marketing site serves Strict-Transport-Security: max-age=31536000; includeSubDomains; preload on every response, so browsers refuse plain-HTTP requests even on a typo'd URL. The app host also serves HSTS on every response.
III
Allow-listed CSP
Content-Security-Policy restricts where scripts, network connections and images may load from: 'self' plus a named allow-list — our app, error monitoring, the support chat, the email-newsletter sign-up endpoint, Cloudflare's analytics beacon, and the analytics and marketing tags that load only after you consent. script-src does include 'unsafe-inline', because the Next.js static export inlines each page's data as script, and the consent-mode bootstrap and most of the consent-gated tag loaders run inline too. JSON-LD structured-data blocks are never executed, so they need no exception. No iframes at all: frame-src and frame-ancestors are both 'none'.
IV
Same-origin isolation
Cross-Origin-Opener-Policy: same-origin and X-Frame-Options: DENY. Access-Control-Allow-Origin is pinned to the canonical origin — no wildcard CORS.
Sub-processors

The third parties that help run the platform.

Each entry is a data processor or sub-processor under UK GDPR. The data they touch and the legal basis is set out in the privacy notice; this page is the same list in a one-glance shape.

  • AnthropicInvoice OCR for the SaaS — reads an uploaded invoice to extract amounts and dates (optional, skippable step)US — UK–US transfer safeguards per the privacy notice
  • CloudflareDNS · DDoS protection · CDN · TLS termination · Pages hosting (marketing site)Global anycast
  • Hetzner CloudServer infrastructure (SaaS app, analytics)European Union (Germany / Finland)
  • ClerkAuthentication for the SaaSUS (data residency option in roadmap)
  • StripePayment processing for the SaaSEU / UK / US (Stripe's standard regional model)
  • ResendTransactional email delivery from the SaaSUS / EU
  • MailerLiteOpt-in guidance emails and the Net 30 newsletter from the marketing site (double opt-in)European Union
  • Novu (self-hosted)In-app and email notification orchestration for the SaaSEEA — self-hosted (Germany)
  • Companies HousePublic-register company lookups (debtor verification)UK
  • MigaduMailbox hosting for @robinreturn.co.uk addressesSwitzerland
  • Cloudflare R2Object storage (PDFs, evidence packs)EU jurisdiction · Cloudflare global network
  • OpenPanel (self-hosted)Web analytics — visitor events, no PIIHetzner / Germany
  • SentryFrontend error monitoring (legitimate interest)EU (Frankfurt)
Reporting a vulnerability

Found a hole? Tell us.

We follow RFC 9116. The canonical disclosure contact lives at /.well-known/security.txt and routes to security@robinreturn.co.uk.

What we ask. Give us a clear, reproducible description of the issue and a sensible amount of time to fix it before publishing. We do not currently offer a paid bug bounty, but we will credit the reporter in the changelog at their preference.

What is out of scope. Denial-of-service testing, social engineering, physical attacks, attacks on third-party providers we depend on.