Security & Incident Response Policy

Effective date: 2026-09-21 Contact: [email protected] Operator: Revolution Unlocked ("we," "us"). Full operating-entity and ownership details will be published once the platform is ready for user invites and creator access, following legal review.

1. Purpose

Describes how we protect Platform data and what happens if something goes wrong. This is a description of our current practice, not a certification or a guarantee — no system is perfectly secure.

2. Our security practices

• Encryption in transit for traffic to and from the Platform.
• Access controls that limit who can reach production systems and data, scoped to what a given role or credential actually needs.
• Infrastructure hardening at the hosting, network, and edge layers.
• Data minimization — we limit the personal data we collect in the first place; see the Privacy Policy.
• Our infrastructure, CDN, and payment providers maintain their own security programs, independent of ours — see Hetzner's security practices, Cloudflare's security practices, and Stripe's security practices. Current vendor status is maintained in the Data Processing & Subprocessor Policy.

3. Vulnerability disclosure

If you believe you've found a security vulnerability affecting the Platform, tell us before disclosing it publicly: [email protected]. Include enough detail to reproduce the issue. We do not currently operate a paid bug bounty program; we will acknowledge a good-faith, non-destructive report and work to address confirmed issues. Testing that degrades the Platform for other users, accesses data that isn't yours, or violates applicable law is not authorized and is not covered by this policy.

4. Incident response

When we identify or are notified of a security incident affecting the Platform, we investigate, contain, and remediate it as a priority. Where an incident involves personal data in a way that creates a legal notification obligation, we notify the individuals and authorities required by applicable law, within the timeframe that law sets (for example, without undue delay and, where feasible, within 72 hours of becoming aware, under GDPR/UK GDPR where it applies). Where no specific legal timeframe applies, we notify affected users without undue delay once we have enough verified information to do so responsibly.

5. What we don't promise

This policy describes our practices and legal obligations, not a service-level guarantee of uptime, breach-free operation, or a specific detection speed. It does not create rights beyond what applicable law provides.

6. Changes

We will notify material changes to this policy consistent with the Privacy Policy.

Last updated 2026-09-21