Incident Response Policy

Effective: 20 October 2026 · Reviewed at least once a year

This policy describes how Reachlee responds to security incidents and service disruptions: how we detect them, how we contain and resolve them, who we notify, and how we prevent them from happening again. It supports our Information Security Policy.

1. What counts as an incident

• Security incident: any event that threatens the confidentiality, integrity or availability of Reachlee's systems or the data we hold, such as unauthorized access, an exposed credential, malicious code or abuse of an integration.
• Personal data breach: a security incident that leads to personal data being accessed, disclosed, altered, lost or destroyed without authorization.
• Service incident: an outage or fault that stops the service from working as expected.

2. Roles

A designated incident lead coordinates every response, decides on containment, and manages communication with customers, platform partners and authorities.

3. Detection and reporting

• Incidents are detected through continuous monitoring, logs, alerts, notifications from platform partners and reports from customers.
• Anyone who suspects an incident or vulnerability can report it to tusharkapil@reachlee.co.

4. Severity

Incidents are classified by severity. Incidents that may affect customer data or cause a full outage receive an immediate response at any time; lower-severity issues are scheduled according to their impact.

5. Response steps

1. Identify: confirm what happened, which systems and data are affected, and when it started.
2. Contain: limit the impact, for example by revoking credentials or disabling affected features.
3. Eradicate: remove the root cause.
4. Recover: restore normal service, including from backups if needed, and confirm everything works before closing.
5. Record: keep a timeline of events and actions taken.

6. Notification

• Customers: if a personal data breach affects a customer, we notify them without undue delay and within 72 hours of confirming it, explaining what happened, what data was involved, what we have done and what they can do.
• Platform partners: if an incident involves data received from a platform partner, we notify them as their terms require.
• Authorities: we notify data protection authorities where the law requires it.

7. After every incident

After an incident is resolved, we document the timeline, root cause, impact and the changes that prevent a recurrence, and track those changes to completion.

8. Testing and review

We rehearse this process at least once a year and review this policy after every significant incident and at least once a year.