Response stages and notification timing
The response workflow is to record and assess a report, limit further exposure, preserve relevant evidence, resolve the cause, verify recovery, and consider follow-up changes. Communication should distinguish confirmed facts from an ongoing investigation.
Under GDPR, a controller must notify the relevant supervisory authority of a notifiable personal-data breach without undue delay and, where feasible, within 72 hours of awareness. Notification to affected people follows its own high-risk threshold. A processor notifies the controller without undue delay. The obligation depends on role and circumstances; it is not a blanket promise that every user is notified within 72 hours.
Report a concern
Email support@deepsearch.app with “Security report” in the subject. Include the affected feature or URL, what you observed, and the steps needed to reproduce it. Share only the minimum information necessary to explain the issue.
Investigation and response
The response process is to assess the report, identify affected systems and information, contain the issue, and verify a fix. Relevant operational evidence helps establish what happened and whether additional protective action is needed.
Communication
If an incident creates notification obligations, the relevant facts and applicable law determine who must be informed and when. The Privacy Policy describes our approach. A report acknowledgement is not a confirmation that a vulnerability has been established.