Security Incident Disclosure Policy

Our Commitment to Security and Excellence

As a commitment to transparency and integrity to our stakeholders, in the unlikely event of a security incident or data breach, the following policy will govern our response plan and disclosure of the incident when necessary.  While we certainly take every precaution necessary to prevent any incidents and hope they will never occur, we have a written response plan in place should it be necessary to utilize as part of our commitment to strong IT governance practices to safeguard our systems and data while ensuring the integrity of our products and services.

1. Immediate Response and Assessment

• Act Promptly: Initiate this incident response plan immediately upon discovering a breach or security incident.
• Assess the Impact: Assess the extent and impact of the breach, including the type of data involved and number of individuals affected and formally document the findings.

2. Legal and Regulatory Compliance

• Understand Obligations: RemodelAI continues to monitor changing regulations at the state and federal level and will comply with all relevant data breach notification laws and regulations, both locally and internationally if applicable.
  • https://www.itgovernanceusa.com/data-breach-notification-laws
  • The table below is not meant to be an exhaustive list of all regulations, just to serve as a reference and example of our commitment to legal diligence.

• Reporting Deadlines: All affected individuals will be notified without unreasonable delay but within 30 days of discovery of a breach as RemodelAI’s standard policy. If any specific state law requires notification sooner then 30 days, state law and requirements will supersede our governance policy and we will do everything we reasonably can to meet state guidelines.

3. Internal Communication and Coordination

• Response Team: RemodelAI’s incident response team consisting of a team legal, IT, public relations, and executive leadership will converge to manage and appropriately respond to any security related issues or data breeches.
• Clear Internal Communication: Our communication plans ensure that all relevant internal stakeholders are informed and understand their roles in the response.

4. External Breach Notification

• Timeliness: Notify affected parties without unnecessary delay as per all reporting deadlines discussed in prior section 2 of this policy.
• Clarity and Transparency: Provide a clear, concise explanation of what occurred, the type of data involved, and the potential impact on those affected from the documented investigation conducted as described in section 1 of this policy.

5. Contact Methods

• Appropriate Channels: RemodelAI’s response team will determine the most effective communication channels for notifications of any security incident or breech, which could include, but is not limited to or emails, letters, phone calls, or public announcements, depending on the nature and scope of the breach. The RemodelAI’s response team will determine an appropriate and measured course of action for communication and contact methods at the time of the incident.

6. Actions, Support, & Guidance

• Assistance to Affected Individuals: Depending on the cause, scope and impact of breach RemodelAI will try to offer appropriate support services to affected parties when necessary or reasonable.
• Actionable Steps & Guidance: Depending on the results of the security incident investigation, policy changes may take effect to mitigate any future risk. Advice may also be given on steps the affected individuals can take to protect themselves, such as changing passwords or monitoring their accounts for unusual activity if the scope and impact of the incident warrants these further steps to be taken to protect our customers and consumers.

7. Ongoing Communication

• Updates: RemodelAI will keep affected parties informed about the ongoing investigation, remediation efforts, and any changes that might impact them until all issues are resolved. All communications will be transmitted through our response team.
• Availability for Queries: If an incident should occur, both during and after the incident open channels for questions and concerns from affected individuals and other stakeholders will remain open to ensure we continue to serve all that might be impacted.

8. Documentation and Record Keeping

• Detailed Records: Maintain comprehensive records of the breach, the response actions taken, and communications for accountability and audit purposes.

9. Continuous Enhancement and Future Risk Mitigation

• Post-Incident Analysis: Conduct a thorough analysis of the breach to determine its cause and the effectiveness of the response.
• Policy Improvement: Update security policies, practices, and response plans based on lessons learned to prevent future breaches.

This policy serves as a framework and plan to manage all risks associated with any security incident or data breach should it occur.  Our Privacy Policy, Terms of Service, and Acceptable Use Policies will supersede any policy framework written here.