If something goes wrong, you hear it from us first.
A two-person on-call rota covers the platform, with 24-hour cover in place by November 2026. We tell you about any personal data breach or possible significant incident without delay, so you can meet your own deadlines with regulators.
Reviewed 18 October 2026
Fast enough for your deadlines.
Our 12-hour first notice leaves you most of the 24 hours NIS2 gives you for an early warning, and our 25-day final report arrives before your one-month NIS2 final report is due.
- First notice
- Within 12 hours of becoming aware, with round-the-clock cover from November 2026
- Updates
- At least every 24 hours until contained
- Incident report
- Within 48 hours
- Final report
- Within 25 days, with the cause and what we changed
- Practice
- An incident exercise every year, which partners can join
- Report to us
- security@highintentmedia.com, and a 24-hour phone line for partners (issued by 31 October 2026)
Set side by side, law by law.
The deadlines below are yours as the controller or regulated entity. The right-hand column is what we commit to so you can meet them.
| Law | Your deadline | What we do |
|---|---|---|
| GDPR Article 33 | Tell your regulator within 72 hours of becoming aware | First notice within 12 hours, with what your report needs |
| GDPR Article 34 | Tell affected members without undue delay where the risk is high | Facts for the member notice, and help sending it if you want it |
| NIS2 Article 23 (in Germany, the BSI Act) | Early warning within 24 hours, notification within 72 hours, final report within one month | First notice within 12 hours, updates every 24 hours, incident report within 48 hours, final report within 25 days |
| UK GDPR | Tell the ICO within 72 hours of becoming aware | First notice within 12 hours |
| Cyber Resilience Act Article 14 | Where it applies to an app: early warning to ENISA within 24 hours of an actively exploited vulnerability | First notice within 12 hours |
| US state breach laws, PIPEDA and the Australian Privacy Act | Deadlines and thresholds vary by state and country | First notice within 12 hours, and the facts each notice needs |
Whether the Cyber Resilience Act applies to an app we build for you is being reviewed with our lawyers. Found a vulnerability? Tell us.
Company and continuity
Who we are, who signs, and what protects you if anything goes wrong
OpenSecurity controls
Every control with its status, mapped to ISO/IEC 27001 and BSI C5
OpenPrivacy and data transfers
Our role as processor, sensitive data, retention and transfers
OpenSub-processors
Who else handles member data, where, and under which safeguard
OpenAge checks and biometric data
How age and ID checks will work, and why none run until 30 November
OpenModeration and online safety
Reports, decisions, appeals and the DSA and Online Safety Act duties
OpenAI register
Every AI system on the platform, its status and how the AI Act treats it
OpenLaws register
Every law we build for, with its official text and who carries each duty
OpenQuestions for our security or privacy team? security@highintentmedia.com and privacy@highintentmedia.com. Or request the security pack.