Security Incident Response Policy

This policy covers security incidents affecting the Service, including:

This policy does not cover service outages with no data impact, errors in OEM manual content or AI-generated answers (see the AI Disclaimer), or misuse of an Account by an authorized user of that Account (see the Acceptable Use Policy).

SEV-1 — Confirmed breach. Customer data was accessed, disclosed, altered, or destroyed by an unauthorized party, or we reasonably believe it was.

SEV-2 — Exposure without confirmed access. A control failure made customer data reachable by an unauthorized party, with no evidence that it was reached.

SEV-3 — Vulnerability. A defect that could have led to a SEV-1 or SEV-2 incident, identified before any exposure occurred.

SEV-4 — Security-relevant event. An event with no customer data in scope.

1. Contain. Within 24 hours of becoming aware, remove the exposure — revoke access, disable the affected path, rotate the compromised credential. Containment takes priority over diagnosis, and over preserving the convenience of the fix.

2. Assess. Establish what data was in scope, whose it was, whether it included personal information, how long the exposure lasted, and whether access actually occurred. Where logs can answer the access question, we use them rather than reasoning from likelihood.

3. Notify. In accordance with Section 5.

4. Remediate. Fix the cause, not only the instance.

5. Record. Enter the incident in the breach register in accordance with Section 6.

6. Review. Identify the control that would have caught it sooner, and add it. An incident that produces no change to our detection or process is not closed.

Notification is sent by email to the administrators of the affected Organization and to the individual Users whose personal information was involved. It will describe:

If our assessment is incomplete at 72 hours, we notify anyway with what we know at that point, state plainly what is still unknown, and follow up. A late notification that is complete is worse than a prompt one that is honest about its gaps.

5.1 Regulatory Notification

Canada: we notify the Office of the Privacy Commissioner of Canada in accordance with the breach of security safeguards provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA), where a breach creates a real risk of significant harm to an individual.

Australia: we notify the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). Where we suspect an eligible data breach may have occurred, we complete our assessment within 30 days.

Every incident assessed at SEV-1, SEV-2, or SEV-3 is recorded, whether or not it resulted in notification. Each entry records the date of discovery, the nature of the incident, the data in scope, the determination reached on notification and the reasoning behind it, the remediation applied, and the control added.

Records are retained for at least 24 months from the date the incident is determined to have occurred, in accordance with PIPEDA's record-keeping requirement, and are provided to the Privacy Commissioner on request.

You may request the register entries for any incident affecting your Organization's data.

If you believe you have found a vulnerability in the Service, or that your Account or your Organization's data has been accessed without authorization, contact security@troubleshoothd.com.

We acknowledge security reports within 2 business days.

We do not currently operate a paid bug bounty program. We will not pursue legal action against anyone who reports a vulnerability in good faith, provided they do not access, modify, or retain data belonging to another customer, do not degrade the Service for others, and give us a reasonable opportunity to remediate before disclosing publicly.

Our subprocessors are listed in our Privacy Policy. Where a subprocessor notifies us of an incident affecting customer data held on our behalf, the notification commitment in Section 5 applies from the point at which we are notified, and we will identify the subprocessor involved.

Stated up front, for the same reason as the rest of this document:

These are a function of company stage, not of position. This policy is reviewed against them as the company grows.

This policy is reviewed annually, and after any SEV-1 or SEV-2 incident. We will notify you of material changes at least 30 days in advance by email or through the Service, consistent with our Privacy Policy.

Security reports and vulnerability disclosure: security@troubleshoothd.com

Privacy inquiries: privacy@troubleshoothd.com

General support: support@troubleshoothd.com

TroubleshootHD Inc. — https://www.troubleshoothd.com