Data breaches
If a security incident exposes personal data, this is what we do.
How we prevent and detect them
Our Security Overview lists the measures that keep data safe, from encryption to access controls. We monitor our systems around the clock so we spot unusual activity early.
Our response
- Contain. Stop the incident and limit any further exposure.
- Assess. Work out what data was involved, whose it is and how serious the risk is to the people affected.
- Notify. Tell the customers whose data was involved, as described below.
- Fix. Remove the cause, and check the fix works.
- Review. Write up what happened and what we're changing so it doesn't happen again.
Telling our customers
For data we process on your behalf, we tell your account owner by email without undue delay, and within 48 hours of confirming the breach. The notice covers:
- what happened and when;
- the kinds of data and roughly how many people are involved;
- what we've done and what we're still doing;
- what you may need to do, and who to contact at ThriveDesk.
If we don't know everything yet, we send what we know and follow up as we learn more.
Our own data
For our own data, such as account and billing details, we report a breach to the data protection authority within 72 hours when we have to, and tell the people affected directly if the risk to them is high.
Reporting a suspected breach
If you think ThriveDesk data has been exposed, email help@thrivedesk.com with "Security" in the subject line straight away. To report misuse of ThriveDesk by someone else, see Abuse Reporting.
