Last revised on October 27th, 2026
Scope
Neurosnap Inc. maintains internal procedures to identify, contain, investigate, and respond to security incidents.
This policy covers customer data processed by or on behalf of Neurosnap, including personal information, confidential research data, proprietary sequences, structures and models, job inputs and outputs, and Agent conversations and files. It applies to incidents affecting the confidentiality, integrity, or availability of that data, including unauthorized access, use, disclosure, alteration, or accidental or unlawful loss or destruction.
Unsuccessful attacks and routine service disruptions do not, by themselves, establish a data breach. We assess their impact and handle service communications separately.
How we respond
We promptly assess suspected incidents and escalate them to the personnel responsible for security, privacy, and affected services. Our response is proportionate to the incident’s nature, severity, and potential impact:
- Contain and preserve evidence. Limit further exposure, secure affected systems, and preserve relevant evidence.
- Investigate and assess. Establish the affected data, customers, time period, likely consequences, and applicable notification requirements.
- Remediate and recover. Address the cause, apply appropriate mitigations, and restore services securely, coordinating with relevant providers or specialists as needed.
- Review and improve. Document findings and corrective actions, and review relevant controls, procedures, and training to reduce recurrence.
Customer notification
When we become aware of a security incident compromising customer data, we notify affected customers without undue delay and in accordance with applicable law and contractual requirements. This includes confidential research data even when no personal information is involved.
For privacy breaches, our operational aim is an initial notice to affected users within 72 hours of discovery, or as soon as reasonably possible. This target does not permit us to wait where earlier notification is required. We do not wait for a completed investigation before issuing a required notice; information may be provided in stages.
We communicate through the affected account’s or organization’s designated contact details, or another appropriate channel. Customers should keep those details current. As information becomes available, notices describe:
- The incident, its known or estimated timing, and affected data or services.
- Likely consequences, actions taken or planned, and steps customers can take to reduce harm.
- A Neurosnap contact for questions and material updates as the investigation progresses.
Communications protect other customers’ confidential information and investigation-sensitive details. Notice may be restricted or delayed only to the extent permitted or required by applicable law, including lawful law-enforcement restrictions.
Regulatory and individual notifications
Regulatory reporting and notices to affected individuals are assessed separately from customer notices. We determine the applicable jurisdictions, our role as controller or processor, legal thresholds, and deadlines for each incident. A regulatory 72-hour reporting deadline, where applicable, is not a universal customer-notification deadline.
Where we process personal information on a customer’s behalf, we notify that customer as required and provide available information to support its obligations. We make notifications to regulators or individuals where Neurosnap is legally required to do so and coordinate with customers where appropriate. Applicable law and binding customer agreements govern any additional or earlier requirements.
Major service incidents
For major service incidents, our continuity plan calls for an initial user update within two hours through email or a public service communication. Operational updates may precede a determination that customer data was compromised and do not replace required breach notices.
Records and confidentiality
We document incidents, assessments, response actions, and notification decisions, including reasons a breach does not require notification. Records of all breaches are retained for at least two years after we determine a breach occurred, and longer where required by applicable law, contract, investigation, or legal hold. Two years is a minimum, not a universal deletion deadline.
Incident information is handled under our confidentiality and retention requirements, with access limited to authorized personnel and relevant providers. Sensitive evidence is exchanged through approved secure channels. This recordkeeping provision does not set the retention period for ordinary customer data.
Reporting and questions
Report suspected incidents promptly to hello@neurosnap.ai or our support team. Include a brief description, affected service, approximate timing, and a way to contact you. Do not send passwords, access tokens, or confidential research files in the initial message; we will arrange an appropriate secure channel if needed.
Read this policy alongside our Privacy Policy, Terms of Use, Security Measures, and Agent Architecture & Data Handling. We review our response procedures following significant incidents and relevant operational or legal changes.