Reporting a security issue
If you think you have found a security weakness in excubia.uk, the Excubia platform or apps, or a tracking device we supply, email support@excubia.uk with "Security report" in the subject line.
It helps to include:
- What the issue is, and where you found it — a page address, an app screen, or a device model
- The steps someone would follow to reproduce it
- What you think an attacker could do with it
- How to reach you, if you want to hear back
What happens next
- We acknowledge your report within 5 working days.
- We investigate, and keep you updated at least every 14 days until it is resolved.
- Where the issue sits in a device manufacturer's firmware, we pass it to the manufacturer and tell you we have done so.
- We tell you when it is fixed, and credit you if you would like to be credited.
We do not run a paid bug bounty.
Research in good faith
We will not pursue legal action against anyone who reports a vulnerability to us in good faith and follows this policy. That means:
- Accessing no more data than you need to show the issue exists — and never browsing, keeping or sharing another customer's location data
- Not degrading or disrupting the service for anyone else
- Not tampering with a device or vehicle you do not own
- Giving us a reasonable time to fix the issue before you make it public
Denial-of-service testing, social engineering of our staff or customers, and physical attacks on our premises are out of scope.
Security update periods for devices
UK law requires us to tell you, before you buy, the minimum period for which a connected device will receive security updates. Here are the current periods for the devices we supply to consumers.
| Device | Minimum security update period | Stated by |
|---|---|---|
| Queclink GL30MEU | 3 years from first commercial supply | Queclink statement of compliance, 28 September 2026 |
| Queclink GL320MG | 3 years from first commercial supply | Queclink statement of compliance, 28 September 2026 |
If a device is not listed here, we do not yet supply it to consumers. A copy of the manufacturer's statement of compliance for any listed device is available on request.
The Excubia platform and apps are our own software. We provide security updates for them for as long as your subscription is active.
Your account
Keep your sign-in details to yourself, and tell us straight away at support@excubia.uk if you think someone else has accessed your account. If you are worried that a tracker is being used to follow you, see report a tracker.