Incident Response Policy

This Policy summarizes how DuruVault prepares for, detects, responds to, and learns from security incidents affecting the Services or personal data. It is an internal-practice summary provided for transparency, not a guarantee of a specific outcome or timeline.

1. Scope

Applies to confidentiality, integrity, or availability events affecting DuruVault systems, customer data, or key subprocessors.

2. Lifecycle

Our response follows recognized phases:

• Preparation: security controls, logging, access management, and this policy.
• Detection & analysis: monitoring, alerts, audit logs, and user/provider reports.
• Triage & classification: assess scope, severity, and whether personal data is affected.
• Containment: limit impact (e.g., revoke sessions/credentials, isolate components).
• Eradication & recovery: remove the cause and restore service, including from backups where needed.
• Post-incident review: root-cause analysis and corrective actions.

3. Breach Notification

Where a personal-data breach triggers legal notification duties, DuruVault will notify affected controllers/users and competent authorities within the timeframes required by applicable law (for example, the GDPR's 72-hour authority-notification standard, and applicable Nigeria NDPA and U.S. state-law timelines). Notifications describe, to the extent known, the nature of the incident, likely consequences, and measures taken.

4. Evidence & Coordination

We preserve relevant logs and evidence and coordinate with infrastructure and security subprocessors (including the Emergent platform) during investigation and recovery.

5. Roles

Incident handling is led by DuruVault's security-responsible personnel, who may engage engineering, legal, and provider support as needed.