account42 Security Incident Response Policy

1. Scope

This policy covers any event that affects the confidentiality, integrity or availability of account42 systems or of the personal data account42 processes on behalf of studios and their customers: unauthorized access, data loss or exposure, a compromised credential or key, a vulnerability under active exploitation, or an outage of the booking service.

2. Responsibility

The incident lead is the founder, Amit Ahluwalia (security@account42.comCopy). The incident lead may engage outside security counsel or forensic help at any stage.

3. Detection

Incidents are detected through monitoring and alerting on the application and database, provider security notices (Supabase, Vercel, Stripe, PayPal, Twilio, Resend, Shopify, Wix), the status page, and reports to security@account42.comCopy, which anyone may use.

4. Response steps

a. Triage (within 4 hours of detection): confirm the event, classify its severity (critical: live exposure or loss of personal data or payment data; high: compromised credential or exploitable vulnerability with no confirmed exposure; medium: availability or integrity issue with no personal data involved), and open an incident record with a timeline.

b. Contain (critical and high: within 24 hours): revoke and rotate affected credentials and keys, suspend affected integrations or accounts, and isolate affected systems; preserve logs before any change.

c. Assess: determine what data was affected, which studios and customers, over what period, and how.

d. Eradicate and recover: fix the root cause, restore from backups where needed, verify integrity, and return service with monitoring in place.

e. Notify (see 5).

f. Review: within 10 business days, a written post-incident review recording cause, timeline, impact, what was changed, and what will prevent recurrence.

5. Notification

Affected studios are notified without undue delay and no later than 72 hours after account42 confirms a personal-data breach, with what happened, what data was involved, what account42 has done, and what the studio should do. Platform partners (Shopify, Wix, WordPress.org) are notified where their merchants’ data is involved, in line with their partner terms. Regulators and individuals are notified where the law applicable to the affected studio requires it. The status page records service-affecting incidents.

6. Records

Incident records, timelines and post-incident reviews are retained for at least 5 years.

7. Testing

This policy is reviewed at least annually and after every critical or high incident.