Security Incident Response
Draft — attorney review required. This document is a working draft for Evidentum launch preparation. It is not legal advice and must be reviewed by qualified counsel before production use. Privacy and security statements must match the live product.
Draft v1 · Aug 2026. How we handle Security Incidents. Binding processor notice commitments are in the DPA.
- Detect → triage → contain → notify Customers without undue delay when Customer Personal Data is affected → remediate
- Notify Account admins / designated security contacts with facts reasonably available
- You decide individual/regulator notices unless law obligates us directly
- Vulnerabilities: security@evidentum.ai — see /security
Full draft: docs/legal/15-incident-response.md
Related: Terms · Privacy · AUP · DPA · Subprocessors · Refunds · Cookies · Security · AI Disclaimer · Support · API Terms · SLA · Enterprise · Beta