Security

Incident Response Timeline

We run a 24×7 on-call rotation backed by a written incident-response runbook. Our commitments for confirmed security incidents:

• < 15 min — detection and triage alert
• < 1 hour — containment measures in place
• < 72 hours — regulator notification for personal-data breaches (GDPR Art. 33)
• < 72 hours — affected-user notification without undue delay
• < 30 days — post-incident report published to enterprise customers on request
• Backups — daily snapshots, 30-day retention, tested quarterly

Full process: /incident-response

Owner's Reservation of Rights

The security measures, controls, response timelines, and compliance posture described on this page are operational practices that may evolve. The Owner reserves the absolute, exclusive, and unfettered discretion, with or without prior notice and without liability, to add, change, restructure, or remove any security control, sub-processor, vendor, or process; to modify, restructure, or replace any feature, plan, integration, price, fee, FX rate, credit weight, quota, rate-limit, discount, coupon, reward, or facility — partially or fully; to suspend, restrict, or terminate any user or account at any time with or without cause; and to modify or replace any related policy with effect upon posting (subject only to legally-required minimum notice). The Owner's Universal Reservation of Rights — Terms of Service section 1.1, the Authorized-Use License in section 1.2, the Benefits Reservation in section 1.3, the Dynamic Pricing & FX clause in section 1.4, and the Comprehensive Owner Protections in section 18 — and the No-Refund Policy are incorporated into this page in full. No security incident, security-control change, vendor change, downtime, outage, breach, or any other event gives rise to any refund, credit-back, pro-rated reimbursement, alternative compensation, SLA payout, or service credit of any kind. You waive any claim to refund, credit-back, pro-rated rebate, alternative compensation, or specific performance arising from the exercise of these rights or from any such event, except only where applicable mandatory law preserves an unwaivable right and only to the absolute minimum the law requires.