Incident Response Policy

1. Purpose

This policy sets out how Seen CRM detects, contains and recovers from security incidents, and how it informs those affected.

2. Scope

This policy applies to any event that threatens the confidentiality, integrity or availability of the platform or of customer data.

3. Policy

1. Reporting. Anyone may report a suspected incident or vulnerability to info@seencrm.com.
2. Classification. Every reported event is assessed and assigned a severity. Where there is doubt, the higher severity applies.
3. Containment. Incidents are contained as quickly as possible. Evidence is preserved before any repair.
4. Customer notification. Customers affected by an incident involving their data are notified without undue delay, with the information they need, including to meet their own legal obligations.
5. Regulatory notification. Seen CRM notifies the competent authorities where required by the Personal Data Protection Law and other applicable laws.
6. Learning. Every significant incident is followed by a written review of its root cause and the corrective actions taken.

4. Responsibilities

Management decides on severity for major incidents and on all external notifications. The engineering team carries out containment and recovery.

5. Exceptions

No exception may delay a notification required by law.

6. Review

This policy is reviewed at least once a year, and after any major security incident.

7. Contact

Questions about this policy: info@seencrm.com