Incident response

Report a concern

Report suspected unauthorised disclosure or a security issue to vexidopublications@gmail.com, using the subject “Vexido security concern”. Describe what you observed and the affected page. Do not attach confidential client records or exploit the issue further.

This mailbox is not represented as a continuously monitored emergency channel. A designated incident owner and escalation arrangements must be established before customer-data services launch.

Response requirements

Record the report, assign an owner, preserve relevant evidence and assess severity. Contain unauthorised access without destroying evidence, revoke affected credentials where appropriate and coordinate with providers. Identify the affected data, individuals, customers and processing systems.

Notification decisions

Assess notification duties separately under applicable law and contracts. Determine the trigger, responsible parties and deadline promptly; do not assume a single deadline applies worldwide. Record the decision and rationale, including when notification is not required. Notices must be accurate, proportionate and avoid unnecessary disclosure.

Recovery and learning

Restore safely, verify remediation, inform affected parties where required and document corrective actions. Review root causes and prevention measures. No completed incident-response test or 24-hour response commitment is claimed at this stage.