Incident Response Summary
Last updated: October 12, 2026
Part of the JorgAI security and trust documents.
| Document control | |
|---|---|
| Document | Incident Response Summary |
| Practices in effect since | Platform launch, April 2026 |
| Formal issue | October 2026 |
| Last reviewed | October 12, 2026 |
| Owner and approver | Founder, JorgAI LLC |
| Related documents | Cybersecurity Policy; Information Security Policy |
1. Scope
Any suspected unauthorized access to, or use of, customer data held by JorgAI: brokerage tokens and account data, account credentials, personal data, or the systems that hold them.
2. Procedure and timelines
| Step | Action | Timeline |
|---|---|---|
| Contain | Revoke affected brokerage tokens, delete them from JorgAI systems, rotate the encryption key and any exposed credentials, invalidate affected sessions, pause automated trading for affected accounts | Within hours of awareness |
| Assess | Establish which accounts, data elements and time window were involved from the audit log, infrastructure logs, error monitoring and cloud API activity logs | Same day |
| Notify partners | Written notice to affected broker or platform partners with the facts known, accounts affected, data elements and containment steps; updates until closure | Within 24 hours of confirming unauthorized access to their customers' information |
| Notify customers | Plain-language notice of what happened, what data was involved, what JorgAI did and what the customer should do | Without unreasonable delay and within applicable law; 72-hour target |
| Recover | Redeploy from versioned application images; restore the database from automated backups or point-in-time recovery | Service restored within 4 hours; data loss limited to 5 minutes |
| Report | Written post-incident report with timeline, root cause, data affected and corrective actions | Within 10 business days |
3. Reporting a concern
Suspected security issues can be reported to support@jorgai.com. JorgAI acknowledges reports and does not pursue action against good-faith researchers who respect customer data and give reasonable time to fix an issue.