What counts

Unauthorised access to customer content, loss of customer data, a confirmed breach of tenant isolation, or an outage beyond the agreed threshold.

What happens

1. Contain, then confirm scope. We do not notify on suspicion alone, and we do not delay to look better
2. Notify affected customers within the window set in your agreement, with what we know and what we do not yet know
3. Regulatory notification where it applies — including the 72-hour GDPR window
4. Publish a written post-incident account, including what we changed

Reporting something to us

Email security@bvlogic.com. We aim to acknowledge within three business days. Please do not test in ways that degrade service for others or reach data that is not yours.

Our own monitoring watches for the failure mode that matters most here: an alert that reports success without having been delivered. That defect was real, it silenced six notifications, and the fix is described in the changelog.