GoRefer Trust Center

Incident Response

Updated September 2026

About this page. The procedures and recovery times described here are our policies and targets. They are not an independent audit, a contractual SLA or proof that a scheduled review has taken place. For current details, assessment reports and records, make a request through the Trust Portal.

GoRefer publishes an incident-response process with severity-based targets. You can ask us for the current response plan, on-call coverage and incident records. The targets below are not a guarantee of response or resolution time.

Response policy

Incident process

Published targets

Incident Severity Levels & Targets

Updated September 2026

Severity	Definition	Response Target	Target Resolution	Notification Target
P0 – Critical	Active breach, data exfiltration, complete service outage	15 minutes	4 hours target	Customer + status page update within 1 hour
P1 – High	Significant data exposure risk, major feature outage, auth bypass	1 hour	24 hours target	Status page update + email to affected customers within 4 hours
P2 – Medium	Limited data exposure, feature degradation, suspicious activity confirmed	4 hours	72 hours target	Status page update within 8 hours; customer email if data is involved
P3 – Low	Minor vulnerability, no immediate data risk, isolated issue	24 hours	2-week sprint	Internal tracking; customer notification at discretion

GDPR 72-hour notification obligation

Where GDPR applies, the controller assesses whether supervisory-authority notification is required under Article 33 and, when required, notifies without undue delay and where feasible within 72 hours of awareness. The high-risk threshold applies to data-subject notification under Article 34. As a processor, GoRefer notifies the customer without undue delay so the controller can assess its duties.