GILNEX Incident Response Policy

Last Updated: July 12, 2026

This policy describes how GILNEX detects, responds to, and communicates about security incidents affecting personal information.

1. Detection & Triage

We monitor systems for anomalies and log security-relevant events. Suspected incidents are triaged by severity and scope, and an incident owner is assigned.

2. Containment & Eradication

We act to contain the incident (for example, rotating credentials, isolating systems, or blocking access), remove the root cause, and restore affected services from verified backups.

3. Notification

Where a confirmed breach affects personal information, GILNEX notifies affected clients without unreasonable delay — targeting within 72 hours of confirmation — consistent with California law (Cal. Civ. Code §1798.82 / CCPA). For clients under a Business Associate Agreement, breach notification of Protected Health Information follows the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D).

4. Post-Incident Review

After resolution we conduct a review to identify contributing factors and corrective actions, and we update controls accordingly.

5. Contact

To report a suspected incident, contact [email protected]. For privacy questions, contact [email protected].