Security Contact

If you believe you have discovered a security vulnerability or have experienced a security incident, please contact us immediately:

Incident Classification

We classify security incidents into the following severity levels to ensure appropriate response:

• Critical: Active data breach, unauthorized access to production systems, or exposure of sensitive data. Immediate response initiated.
• High: Vulnerability that could lead to data exposure if exploited, or a confirmed unauthorized access attempt. Response within 4 hours.
• Medium: Security misconfiguration, policy violation, or vulnerability with limited exposure risk. Response within 24 hours.
• Low: Minor security improvement opportunity or informational finding. Response within 72 hours.

Response Timeline

• Acknowledgment: All security reports are acknowledged within 24 hours of receipt.
• Initial Assessment: A preliminary severity classification and impact assessment is completed within 48 hours.
• Containment: For critical and high-severity incidents, containment measures are implemented as soon as the incident is confirmed.
• Resolution: We work to resolve confirmed vulnerabilities and incidents as quickly as possible, with target resolution times based on severity.
• Post-Incident Review: A root cause analysis is conducted after resolution to prevent recurrence.

Notification Procedures

• Affected districts and schools are notified promptly when a confirmed incident impacts their data.
• Notifications include a description of the incident, the data affected, steps taken to contain and resolve the issue, and recommended actions.
• For incidents requiring regulatory notification, VisioLang will coordinate with affected districts to meet applicable reporting timelines.
• Non-affected customers may receive a general security advisory if the incident has broader relevance.