Incident response

Proxara’s part in an incident is anything it ships: the installer, the application, the model, the rules and the registry they come from. Your install itself is yours, inside your own security program, and Proxara never needs access to it to help.

If Proxara finds a problem in what it ships

1. Contain it. Withdraw the affected release from the registry so no install pulls it.
2. Tell you. Within 72 hours of confirming the problem, every affected lender hears from a person at Proxara: what happened, which releases it touches, whether any customer information could have been exposed, and what to do.
3. Fix it. Publish a signed release that fixes it, and say what changed.
4. Write it up. Send each affected lender a written account once it is closed: the cause, the timeline and what changed so it doesn’t happen again.

The notice comes early enough for your own obligations, including the FTC’s notice for an event involving 500 or more consumers (16 CFR 314.4(j)).

If you find a problem in your environment

Your team runs its own response. Proxara answers questions about the install, reads any diagnostics bundle your IT chooses to send, and ships a fixed release if the cause is in Proxara’s software. Because the install holds no Proxara access, there is nothing of Proxara’s to revoke.

Reporting a vulnerability

Write to security@proxara.ai. Say what you found, where, and how to reproduce it, and leave out any borrower’s information. A person replies, keeps you told while it is fixed, and credits you if you would like. Please give us a reasonable time to ship a fix before you publish.