Governance & Evaluation
Incident Disclosure Policy
Purpose
Governs disclosure of security, privacy, and AI safety incidents.
Scope
All material incidents affecting user data, system availability, or AI safety.
Definitions
Precise Materiality Definition A Material AI Safety Incident is any event meeting one or more of: (a) a model produces harmful output at scale (affecting more than 100 users or a single enterprise customer's production environment); (b) a jailbreak or prompt injection technique achieves reproducible bypass of a Level 2+ safety mitigation and is confirmed exploitable in production; (c) an autonomous agent executes an unauthorized Consequential Action (per Doc. 20's definition); (d) a CBRN-adjacent red line is breached in production, regardless of scale. Any incident not meeting these thresholds is logged internally but not subject to the public/regulatory disclosure timeline below.
Policy Statements
Data breaches affecting personal data are disclosed to affected users and regulators within 72 hours of confirmation. Material AI Safety Incidents (per the definition above) are disclosed via the Trust Center within 5 business days with root-cause summaries. Severity is classified Low/Medium/High/Critical, driving notification timelines and executive escalation.
Responsibilities
CISO and Chief Privacy Officer jointly own breach disclosure; AI Safety Research Lead owns safety incident disclosure and materiality determination.
Compliance Requirements
Regulatory notification deadlines take precedence over internal review timelines; materiality determinations are logged and auditable.
Enforcement
Failure to disclose within required timelines triggers internal audit and corrective action.
Reporting Process
security@webspaceai.in; public disclosures at https://webspaceai.in/trust.
Exceptions Process
Law enforcement holds may delay disclosure with documented legal basis.
Review Process
After every material incident and quarterly otherwise.