Trust center / Policies
Incident Response Policy
What we do when something goes wrong, and when customers hear about it.
Version 1.0 · effective 2026-10-29 · owner Franklin Lupichuk, Founder
Reporting
- Anyone can report a suspected security problem to security@rendro.net. We acknowledge reports within 3 business days.
- How to report a vulnerability, and our promise to people who report in good faith: www.rendro.net/security/vulnerability-disclosure.
Response
- Contain: stop the problem from spreading, for example by revoking keys, disabling an account or taking a feature offline.
- Assess: work out what happened, which workspaces and data are affected, and whether personal data was involved.
- Fix the cause, then confirm the fix.
- We follow a written runbook for these steps.
Notification
- If a breach affects a customer's data, we notify the customer without undue delay and within 72 hours after becoming aware of it, with what we know and what we're doing, and update them as we learn more (our DPA, section 6).
- We report to regulators and notify individuals where the law requires it, including under PIPEDA in Canada.
Records and review
- We keep a record of every breach of security safeguards involving personal information, as PIPEDA requires.
- After each incident we write down what happened and what we changed so it doesn't happen again.