How can we help?

If you suspect a security incident involving your Polyosync account, business environment, AI Employees, integrations, or customer information, report it promptly. Early reporting helps the relevant teams assess the situation and determine appropriate next steps. What situations should be reported? Examples include: 1. Suspected unauthorized account access. 2. Unexpected access to another organization's information. 3. Exposed API credentials. 4. Suspicious administrative changes. 5. Unauthorized integration activity. 6. Unexpected AI Employee access to sensitive resources. 7. Potentially unsafe automated operations. 8. Suspected disclosure of confidential business data. 9. Repeated unexplained authentication or authorization problems. 10. Evidence of a possible security vulnerability. How do I report the issue? Use the available Polyosync Support channel or support ticket process. Clearly indicate that the report concerns a potential security incident. What information should I include? 1. The affected account or business environment. 2. The relevant feature. 3. The approximate date and time. 4. A description of the unexpected behavior. 5. The steps that led to the issue. 6. Whether the behavior is ongoing. 7. The potential business impact. 8. Any non-sensitive evidence. What should I avoid including? Do not include: 1. Passwords. 2. API keys. 3. Authentication tokens. 4. Private keys. 5. Unnecessary customer records. 6. Confidential information belonging to unrelated organizations. What should I do while waiting for a response? If you can safely limit the impact using authorized controls, take appropriate protective action. Examples may include changing exposed credentials, stopping an affected workflow, or notifying an internal administrator. Do not attempt to investigate other customers' data or exploit a suspected vulnerability. Will every report be considered a confirmed security incident? No. An unexpected result may have several explanations, including configuration errors, incorrect permissions, or inaccurate AI-generated content. The available evidence must be assessed before a conclusion is reached. What if the issue involves a third-party AI provider? Polyosync uses external AI providers to support relevant platform functionality. A report should identify the affected Polyosync operation without assuming that the external provider caused the issue. The investigation should consider the actual processing path and available evidence. What happens to business data during an investigation? Business data remains subject to the applicable privacy, security, and contractual obligations. Polyosync's principle is that customer business data belongs to the customer. Polyosync does not sell customer business data or use it to train its own AI models. What if the incident may involve personal data? Notify the appropriate internal privacy or security contact. Organizations may have legal obligations concerning assessment, documentation, or notification of personal data breaches. The applicable requirements depend on the circumstances and jurisdiction. Recommended practice Report suspected security incidents promptly, provide accurate information, protect sensitive evidence, and cooperate with authorized investigation procedures.