Incident Response Policy

1. Purpose

This policy describes how Insuriant AI responds to security incidents affecting the Services or personal information we process.

2. Definitions

• Security Event. An observed condition that may indicate a problem.
• Security Incident. Confirmed or reasonably suspected unauthorized access, acquisition, use, or disclosure that compromises the confidentiality, integrity, or availability of protected systems or personal information.

3. Detection and reporting

We identify potential incidents through monitoring, notices from service providers, and reports from users. To report a suspected incident, email support@insuriant.ai with the subject line “Security Incident.”

4. Response

Our response includes:

1. Triage and severity assessment
2. Containment, including credentials, access, traffic, and integrations as appropriate
3. Investigation of scope and cause as reasonably practicable
4. Remediation and recovery
5. Notification as required
6. Documentation and corrective action

5. Notification

After we confirm a Security Incident that requires notice to an affected business customer under contract, or to individuals under applicable law, we will provide notice within seventy-two (72) business hours after confirmation, subject to lawful delay (including law-enforcement requests) and to any shorter period required by applicable law. “Business hours” means hours during U.S. Eastern Time business days. The content and method of notice follow applicable law and contract.

6. Coordination

When a business customer is primarily responsible for the relationship with end users, we coordinate with that customer’s designated contact. We do not disclose investigative detail that would increase risk during an active investigation.

7. Evidence

We preserve relevant logs and artifacts for investigation and legal needs. A legal hold supersedes routine deletion when directed.

8. Contact

support@insuriant.ai

Insuriant AI, Wellington, FL 33414, United States