We validate the security posture of our applications by engaging an external third party to perform an annual penetration test. We are also subject to an ongoing, private bug bounty program and encourage security researchers to disclose security vulnerabilities to us in a responsible manner.  Regularly scheduled scans of our applications and infrastructure are also in place to confirm that all aspects of our systems are regularly inspected for potential weaknesses. Vulnerability management is performed based on the perceived threats and prioritised in accordance with Deputy’s risk tolerances.