Incident response policy

A security incident is any confirmed or reasonably suspected unauthorized access to, disclosure of, alteration of or loss of customer data, or a compromise of the systems that hold it.

• Reports sent to security@gettitlemagic.com.
• Automated checks of the website and database every five minutes, shown on the public status page.
• The access log and audit trails described in the security overview.
• Rate limits on public endpoints, and new-device sign-in emails to account holders.

• Confirm and scope. We confirm what happened and use the access log, audit trails and server logs to work out which companies and data are affected.
• Contain. Depending on the incident: turn off the affected feature or route, replace or expire Magic Links, sign every user out by changing the session secret, rotate secrets and encryption keys, or roll the application back to the previous release.
• Recover. Restore normal service and, if needed, restore data from the most recent verified backup. Restoring older data over newer data needs approval from TitleMagic’s owner.
• Notify. We notify affected customers without undue delay so they can meet their own obligations, and give any other notice the law requires. A notice says what happened, what data was involved, what we did and what we recommend you do.
• Review. We record what happened and what we changed to prevent a repeat.

Email security@gettitlemagic.com with “Security report” in the subject and enough detail for us to reproduce it. Please do not access, change or delete data that is not yours while testing.

No system is perfectly secure and we cannot guarantee that incidents will not occur. This policy describes what we do; it does not change the Terms of Service or Privacy Policy.