Vulnerability Disclosure Policy

Coordinated Vulnerability Disclosure

Spoken Ink Limited (incorporated in England and Wales under Registered Number 06968714, ISO 27001 certified) prioritises the security and resilience of our passenger transport software, closed-circuit media platforms, and public-sector digital infrastructure. In alignment with UK National Cyber Security Centre (NCSC) guidance and RFC 9116, we welcome good-faith vulnerability reports from security researchers, public-sector assurance teams, rail operators, and partner organisations.

1. Scope

• www.whooshmedia.co.uk and www.spokenink.co.uk
• Internet-facing web applications, accessible station mapping interfaces, and passenger information endpoints operated directly by Whoosh and Spoken Ink.
• Third-party services not operated by Spoken Ink Limited should be reported directly to the relevant provider or via the UK NCSC Vulnerability Reporting Service.

2. How to Report a Vulnerability

Please send vulnerability reports to Security Team at security@spokenink.co.uk. Our machine-readable disclosure manifest is published at /.well-known/security.txt.

To help us triage quickly, please include:

1. The affected domain, URL, endpoint, or software component.
2. Clear, reproducible steps or a minimal proof-of-concept demonstrating the issue.
3. An explanation of the potential security or operational impact.
4. Your preferred contact details if you wish to receive remediation updates.

3. Rules of Engagement (Good-Faith Research)

• Act in good faith to avoid privacy violations, service disruption, or data alteration.
• Do not access, copy, modify, or delete data belonging to passengers, rail operators, airline partners, healthcare networks, or public-sector authorities; stop testing immediately if sensitive data is encountered and notify us.
• Do not perform denial-of-service (DoS/DDoS) testing, high-volume automated scanning that degrades availability, physical security testing, or social engineering and phishing against personnel.
• Maintain confidentiality and allow reasonable time for remediation before any public disclosure.

4. Our Commitment & Safe Harbour

• Acknowledgement: Our Security Team aims to acknowledge receipt within 3 business days.
• Triage & Remediation: We aim to provide an initial assessment within 10 business days and remediate validated findings by severity under our ISO 27001 Information Security Management System.
• Good-Faith Safe Harbour: Where research is conducted in good faith and strictly within this policy, Spoken Ink Limited treats the activity as authorised security testing and will not initiate legal action against the reporter.

Effective date: 6 November 2026 · Next scheduled review: November 2027.