Cyber Incident Response Plan

Effective 30 September 2026.

1. Purpose

This plan gives People By Heart (“People By Heart”) a structured, repeatable way to respond to information security incidents affecting its systems, its data, or the data it holds with third-party providers. Its goals are to respond quickly and consistently, to limit harm to the people who use the Service and to those they write about, to document what was done, and to improve the security program after each incident.

2. Scope

The plan covers every system that stores or processes People By Heart data: the API and website on Vercel, the database on Neon, the photo store on Amazon Web Services, the OpenAI API, the email provider Resend, the App Store account, and the machines and accounts used to build and run them. It applies to everyone with access to those systems, which at present is one person.

3. Accountability

Alex MacDonald is the Information Security Coordinator, responsible for implementing this plan, responding to incidents, deciding on communications and notifications, reviewing each incident afterwards, and reviewing this plan at least once a year or whenever the Service changes in a way that affects it. Suggested changes go to support@peoplebyheart.com.

4. Definitions

Confidential information is anything not public. Personal information is anything about an identifiable person: a user's account details, their notes and the facts filed from them, voice recordings, photos, contact details, calendar events they act on, their card, and everything a note says about the people it describes, who are not users. An information security incident is an actual or reasonably suspected loss, theft, unauthorised access, use or disclosure of confidential or personal information, or unauthorised access to, loss of, or malicious infection of any system in scope.

5. Detection and reporting

Incidents are found through the hosting platform's logs and alerts, the database and storage providers' access logs, the bot check on the website, and reports from users, researchers or providers. Anyone who suspects an incident should report it at once to support@peoplebyheart.com with “Security” in the subject line, and should not investigate on their own. Every report is assessed, and every incident is recorded with the date, what was affected, and what was done.

6. Containment, remediation and recovery

The response depends on what was exposed. The standard first steps for this stack are:

A leaked secret (the OpenAI key, storage keys, the email key, or the authentication secret): rotate it with the provider and in the hosting configuration within the hour, redeploy, and if the authentication secret was exposed, end every session so that everyone signs in again.
Database exposure (credentials or a copy of the data): rotate the connection string, review the provider's access log to establish what was read and when, and end every session.
Photo store exposure: block public access, rotate keys, and use the access logs to list what was fetched.
An account taken over through a leaked password or a compromised Apple ID: end that account's sessions, offer a password reset, and contact the account holder.
A shared card or household link abused: withdraw the link, record the report, and if needed close the abusing account.

After containment, the cause is fixed, affected data is restored from backups where it was altered or lost, and the Service is watched for recurrence.

7. Communications and notifications

The Coordinator decides all internal and external communications. Where the law or an agreement requires it, People By Heart will notify:

Affected people: without unreasonable delay and within 60 days of determining that a breach of personal information occurred, as Texas law requires, or sooner where another state's law sets a shorter period. The notice says what happened, what information was involved, what we did, and what the person can do.
Authorities: the Texas Attorney General within 30 days when 250 or more Texas residents are affected, and other regulators or law enforcement as the law requires.
Providers and partners: the provider whose system was involved, and Apple where the app or its store listing is affected.
Insurer: the cyber insurance carrier, if a policy is in force, on its terms.

8. Post-incident review

Within a reasonable time after each incident, the Coordinator reviews what happened, how it was found, how the response went, and what should change, and tracks the follow-up actions to completion. Lessons feed the next review of this plan and of the Information Security Policy.

9. Plan review

This plan is reviewed at least annually and whenever there is a material change to the Service or its providers. The Coordinator approves changes and records them below.

Revision history: original publication, 30 September 2026.