Tarosyn Legal

Incident Response Policy

Last updated May 31, 2026

Tarosyn stores personal data that matters to you — birth details, spiritual reflections, messages, and payment records. We treat the security of that data as a core responsibility. This policy describes how we detect, investigate, contain, and communicate security incidents, including our commitments on notification timelines for users and regulators.

PHASE 1

Detection & Triage

We monitor our systems continuously and investigate every credible signal of unauthorised access or data exposure.

Automated alerting is in place for anomalous authentication patterns, unexpected data-access volumes, and infrastructure-level events. Security reports submitted by external researchers through our Bug Bounty programme are triaged within two business days. When an alert is triggered, an on-call engineer performs an initial triage to confirm whether a real incident has occurred and, if so, its probable scope. Incidents are classified by severity — Critical (data confirmed exposed or systems actively compromised), High (credible risk of exposure), Medium (potential vulnerability, no confirmed exposure), and Low (informational).

PHASE 2

Containment & Escalation

Once an incident is confirmed, we act immediately to contain the damage and escalate to the right people.

For Critical and High incidents, containment steps — such as revoking compromised credentials, blocking malicious IPs, or isolating affected services — are initiated within one hour of confirmation. A named Incident Commander takes ownership and coordinates response across engineering, legal, and communications teams. All incident activity is logged in a secure, append-only record to support investigation and post-incident review. Compromised sessions or authentication tokens are invalidated as soon as the vector is understood. Where a third-party service is involved (e.g., a cloud provider or sub-processor), that vendor is notified and engaged in parallel.

PHASE 3

User & Authority Notification

We commit to notifying affected users and relevant authorities without undue delay — and no later than 72 hours after we confirm a breach.

If a breach is confirmed and personal data has been, or is likely to have been, accessed without authorisation, Tarosyn will notify affected users within 72 hours of that confirmation. Where applicable law requires notification to a supervisory authority (e.g., a Data Protection Authority under GDPR or a state Attorney General), we will file that notification within the same 72-hour window. User notifications are sent by email to the address on record and, where technically feasible, as an in-app notice. They will describe: what happened, what data was involved, what we have done to address it, and what steps you can take. We will not delay user notification to conduct a full investigation — we communicate what we know when we know it, and follow up with further detail as the investigation concludes. Where a breach is limited to encrypted or pseudonymised data with no demonstrated risk to users, we may determine that individual notification is not warranted; that determination and its reasoning will be documented.

PHASE 4

Recovery & Post-Incident Review

After containment we restore normal operations, verify integrity, and conduct a structured review to prevent recurrence.

Affected systems are restored from verified clean backups or rebuilt from source where appropriate. A post-incident review is conducted within 14 days of incident closure. It covers root cause, timeline, response effectiveness, and remediation actions. Remediation items are tracked to completion with defined owners and deadlines. Significant incidents are summarised in our internal security log; material incidents affecting user data are disclosed in our annual transparency summary. Lessons learned are fed back into our security controls, monitoring, and team training. Timeline commitments at a glance Initial triage Within 2 hours of alert Containment initiated (Critical / High) Within 1 hour of confirmation User & authority notification Within 72 hours of confirmed breach Follow-up user communication As investigation progresses Post-incident review Within 14 days of incident closure Scope & limitations

This policy covers incidents affecting Tarosyn's production systems, user data, and the services we operate. It does not govern third-party providers — such as cloud infrastructure, payment processors, or model vendors — beyond the contractual obligations we place on them as sub-processors.

Timelines are measured from the point at which an incident is confirmed by Tarosyn staff. Detection lag (the period between an incident occurring and our becoming aware of it) is not included in these commitments, though we work continuously to minimise it.

This is a public-facing policy summary. Detailed operational runbooks, escalation trees, and vendor-specific playbooks are maintained internally and are not published here.

Reporting a suspected incident

If you believe you have discovered a security vulnerability or have evidence of unauthorised access to Tarosyn systems or your account, please contact us immediately at [email protected]. Include as much detail as you can — we read every message and will acknowledge receipt within two business days.

For general support questions, please use [email protected] instead.

Trust Center Security Overview Bug Bounty Programme

Questions? [email protected]