Security and responsible disclosure

Last updated: 27 October 2026

This website

• Encrypted only. The site is served over HTTPS, and modern browsers connect using TLS 1.3. Plain http:// and www addresses redirect to https://finforce.com.au.
• Only our own code runs. Every page carries a Content Security Policy that blocks scripts from anywhere except this site and Calendly’s booking window. There are no advertising or tracking scripts.
• No framing. Pages refuse to display inside another website’s frame, and the sign-in pages stay hidden unless they are the page you opened.
• Nothing about you in the code. No client names, documents or account details are stored in the website files.

The Client Portal

• No passwords to steal. You sign in with a one-time link sent to the email address we hold for you. Each link works once and expires after 15 minutes.
• Sessions end on their own. You are signed out after 30 minutes of inactivity, and every session ends after 4 hours.
• Your folder only. Each sign-in can only see and add to the folder set up for that client. Documents are kept in FinForce’s private Google Workspace, not on this website.
• Limits on requests. Login links and uploads are rate limited, and the portal gives the same reply whether or not an email address is registered.

Protecting yourself from scams

We will never ask for your password, ask you to pay into a new bank account by email, or send a login link you didn’t request. If something looks wrong, don’t click it: call us on 07 3262 6585 using the number on this site. Please don’t send tax file numbers, passwords or bank details through website forms.

Reporting a security issue

If you think you have found a security problem with finforce.com.au or the Client Portal, please email admin@finforce.com.au with “Security report” in the subject. Tell us what you found, the page or address involved, and the steps to reproduce it. We aim to acknowledge reports within two business days. Our contact details are also published in security.txt.

When testing, please don’t access or change anyone else’s information, run denial-of-service or automated high-volume scans, or try social engineering or phishing on our team or clients. Give us a reasonable time to fix an issue before telling anyone else. We appreciate reports made in good faith and will keep you updated.

Privacy

How we handle personal information is set out in our privacy policy.