Version 3 · Effective 2026-08-15

This document is a draft and has not yet been reviewed by legal counsel. It is not yet in effect.

Incident Response Policy

Version: 3 · Last revised: August 15, 2026 · not yet in effect — see the notice above

This policy describes how Coachstra responds to a suspected or confirmed security incident affecting Customer Data.

1. Detection

Coachstra does not yet run automated security monitoring or alerting. Detection today depends on platform-level notifications from our infrastructure providers, errors surfacing in application logs, and reports from coaches or their clients — which is why the reporting route in our Security Policy matters, and why we treat every report seriously rather than triaging it against an alert that may not exist.

Automated monitoring is planned. We will describe it here when it is running, and not before.

2. Containment and assessment

On detecting a suspected incident, we act to contain it and assess its scope: what data, how many data subjects, and which customers are affected.

3. Notification

Where an incident affects Customer Data, we notify the affected coach(es) without undue delay after becoming aware, and in any event in time to leave them a workable share of their own 72-hour regulatory notification window as controller — consistent with our Data Processing Agreement, Section 8.

4. Remediation

We take corrective action to close the vulnerability or misconfiguration that caused the incident, and document what changed.

5. Post-incident review

Coachstra has no formalised post-incident review process, and does not claim one it could not run consistently. In practice, an incident affecting Customer Data is written up — what happened, what was affected, what changed as a result — and that write-up is what we would provide to an affected controller on request.

A defined review process with owners and timelines will be described here once there is an organisation to run it.

This document describes an intended process. Do not represent it as operationally battle-tested until it has actually been exercised, even in a drill.