Skip to main content
RobinReturn
Start free first reminder on us
Security

What protects
the work.

The marketing surface has no PII and no auth. The SaaS at app.robinreturn.co.uk does, and it is the same regulated boundary your invoice and debtor data lives behind.

Transport & browser

Encrypted, isolated, locked down.

I
HTTPS everywhere
Every request to www.robinreturn.co.uk and app.robinreturn.co.uk is encrypted with TLS 1.2 or higher. Plain-HTTP requests are 301-redirected to HTTPS at the edge.
II
HSTS preloaded
The marketing site serves Strict-Transport-Security: max-age=31536000; includeSubDomains; preload on every response, so browsers refuse plain-HTTP requests even on a typo'd URL. The app host also serves HSTS on every response.
III
Allow-listed CSP
Content-Security-Policy restricts where scripts, network connections and images may load from: 'self' plus a named allow-list — our app, error monitoring, the support chat, the email-newsletter sign-up endpoint, Cloudflare's analytics beacon, and the analytics and marketing tags that load only after you consent. script-src does not include 'unsafe-inline'. The few inline scripts the Next.js static export needs — each page's data and the consent-mode bootstrap — are allowed one by one by their SHA-256 hash, which the build computes for every page, and a CI check fails the build if a page has an inline script without one. The consent-gated tag loaders run from files on our own domain. style-src still allows 'unsafe-inline', for inline styles. JSON-LD structured-data blocks are never executed, so they need no exception. We embed no iframes (frame-src 'none'), and other sites cannot frame our pages (frame-ancestors 'none'), except the embeddable calculator under /embed/, which is built to be framed.
IV
Same-origin isolation
Cross-Origin-Opener-Policy: same-origin and X-Frame-Options: DENY. Access-Control-Allow-Origin is pinned to the canonical origin — no wildcard CORS.
Sub-processors

The third parties that help run the platform.

Each entry is a data processor or sub-processor under UK GDPR. The data they touch and the legal basis is set out in the privacy notice; this page is the same list in a one-glance shape.

  • AnthropicInvoice OCR for the SaaS — reads an uploaded invoice to extract amounts and dates (optional, skippable step)US — UK–US transfer safeguards per the privacy notice
  • CloudflareDNS · DDoS protection · CDN · TLS termination · Pages hosting (marketing site)Global anycast
  • Hetzner CloudServer infrastructure (SaaS app, analytics)European Union (Germany / Finland)
  • ClerkAuthentication for the SaaSUS (data residency option in roadmap)
  • StripePayment processing for the SaaSEU / UK / US (Stripe's standard regional model)
  • ResendTransactional email delivery from the SaaSUS / EU
  • MailerLiteOpt-in guidance emails and the Net 30 newsletter from the marketing site (double opt-in)European Union
  • Novu (self-hosted)In-app and email notification orchestration for the SaaSEEA — self-hosted (Germany)
  • Companies HousePublic-register company lookups (debtor verification)UK
  • MigaduMailbox hosting for @robinreturn.co.uk addressesSwitzerland
  • Cloudflare R2Object storage (PDFs, evidence packs)EU jurisdiction · Cloudflare global network
  • OpenPanel (self-hosted)Web analytics — visitor events, no PIIHetzner / Germany
  • SentryFrontend error monitoring (legitimate interest)EU (Frankfurt)
Reporting a vulnerability

Found a hole? Tell us.

We follow RFC 9116. The canonical disclosure contact lives at /.well-known/security.txt and routes to security@robinreturn.co.uk.

What we ask. Give us a clear, reproducible description of the issue and a sensible amount of time to fix it before publishing. We do not currently offer a paid bug bounty, but we will credit the reporter in the changelog at their preference.

What is out of scope. Denial-of-service testing, social engineering, physical attacks, attacks on third-party providers we depend on.