Security
Incident response.
Effective
Report a security issue to security@inherit.bio. In the first message, include the affected URL and a short account of what you found.
Do not include genome data, passwords, access keys, or other private information. The public security file does not yet name an encryption key.
On this page
Report an issue
Use the contact in our security.txt file. Give us a way to reply, steps that reproduce the issue, and the smallest safe example. Do not test against another person’s account or data.
We will confirm receipt when the mailbox is working. A missing reply is not permission to collect more data, keep access, or publish private material.
Response process
- Start within four hours. A credible report starts an assessment within four hours. We record its scope, affected systems, possible subjects, and first known time.
- Contain and preserve. We stop unsafe access, rotate exposed credentials, and keep only the evidence needed to understand the event. Recovery does not erase the record.
- Assess harm. We identify the data involved, likely effects, people at risk, and steps that can reduce harm. We document confirmed incidents even when no data loss is found.
- Recover and review. We restore safe service, check the fix, and record follow-up work. The public history is updated when the facts can be stated safely.
Notice
Where GDPR Article 33 applies, we notify the proper authority without undue delay. Where feasible, notice is sent within 72 hours after we become aware of the breach. A late notice must explain the delay.
Where GDPR Article 34 applies because a breach is likely to create a high risk, we notify affected people without undue delay. The notice uses plain language and explains the event, likely effects, contact point, and steps taken.
We also notify US state attorneys general on each timeline that applies. Other laws may require more notices or shorter clocks; those rules still control.
Who receives notice
Notice goes to each affected person, not only the account holder. This includes another adult whose genome was uploaded and a genetic parent whose data forms part of an embryo record.
It also includes the subject of a future-person record when a direct contact exists. If that person has made a claim, we notify the claimant through the current claim contact.
Incident history
This history lists every confirmed incident. That includes an incident where our review finds no confirmed data loss. Each entry gives a date, scope, notice status, and repair summary when publication is safe.
— No incidents to report.