Incident response

Proxara’s part in an incident is the service it runs and everything it ships: the application, the phone line’s account and the data it holds. The lender’s own systems sit inside the lender’s own security program.

If Proxara finds a problem

1. Contain it. Stop the affected part, withdraw any credential it touched, and tell the officers how to put their calls back on their phones if the line is affected.
2. Tell you. Once Proxara discovers a breach of data it holds, it tells the officer, and the lender’s named security contact where the lender has given one, without unreasonable delay: what happened, what data it touches, and what to do. That is what state breach laws ask of a company that keeps data it doesn’t own.
3. Fix it. Ship the fix, and say what changed.
4. Write it up. Send each affected officer and lender a written account once it is closed: the cause, the timeline and what changed so it doesn’t happen again.

The lender, who owns the data, then notifies its borrowers and, under the FTC’s Safeguards Rule, the FTC within 30 days when 500 or more people are affected (16 CFR 314.4(j)). Proxara’s notice comes early enough for both.

If you find a problem in your environment

Your team runs its own response. Proxara answers questions, withdraws or rotates whatever it holds for you when asked, and ships a fix if the cause is in Proxara’s software.

Reporting a vulnerability

Write to security@proxara.ai. Say what you found, where, and how to reproduce it, and leave out any borrower’s information. A person replies, keeps you told while it is fixed, and credits you if you would like. Please give us a reasonable time to ship a fix before you publish.