Incident Response Policy

Kleer Ledger employs continuous monitoring to detect security incidents as early as possible:

• •Automated monitoring systems track application errors, authentication anomalies, and unusual data access patterns around the clock.
• •Infrastructure health metrics, network traffic, and system logs are monitored continuously with automated alerting thresholds.
• •Third-party security advisories relevant to our technology stack are tracked and triaged promptly.
• •Users and security researchers can report suspected vulnerabilities or incidents at support@kleerledger.com.

Upon detection of a potential security incident, Kleer Ledger classifies the incident by severity to determine response priority and escalation path:

• •Critical (P1) — Confirmed or highly probable unauthorized access to user financial data, authentication systems, or infrastructure. Requires immediate response within 1 hour.
• •High (P2) — Suspected breach, service unavailability affecting users, or significant vulnerability actively exploited in the wild. Response initiated within 4 hours.
• •Medium (P3) — Potential security weakness identified, limited service degradation, or suspicious activity requiring investigation. Response within 24 hours.
• •Low (P4) — Non-urgent security improvements, informational findings, or minor anomalies with no immediate user impact. Addressed in regular review cycles.

Upon confirming a security incident, immediate containment steps are taken to limit the scope of impact:

• •Compromised credentials, API keys, or access tokens are immediately revoked and rotated.
• •Affected systems may be isolated from the network to prevent lateral movement or further data exposure.
• •Plaid access tokens associated with potentially affected accounts are revoked pending investigation.
• •Affected user accounts may be temporarily restricted to prevent further unauthorized activity.
• •Network-level controls (firewall rules, IP blocks) may be applied to block malicious traffic sources.

Following containment, a thorough investigation is conducted to understand the full scope, cause, and impact of the incident:

• •System logs, access records, and audit trails are preserved and reviewed to establish a timeline of events.
• •The root cause of the incident is identified, including the specific vulnerability or failure that enabled it.
• •The scope of affected data and affected users is assessed and documented.
• •Whether any user data was accessed, exfiltrated, or altered is determined with as much precision as possible.
• •Third-party forensic expertise may be engaged for critical incidents where internal resources are insufficient.

Kleer Ledger is committed to transparent and timely communication with affected users in the event of a data breach:

• •If we confirm that a breach has resulted in unauthorized access to personal or financial data, affected users will be notified by email within 72 hours of confirmation, where technically feasible.
• •Notification will clearly describe: what happened, what data was involved, steps Kleer Ledger has taken, and actions users should take to protect themselves.
• •We will comply with applicable breach notification laws, including state-level requirements where relevant (e.g., CCPA for California residents).
• •A public disclosure may be published on our website for incidents affecting a significant number of users.

In incidents involving third-party service providers, Kleer Ledger will coordinate response activities accordingly:

• •Plaid will be notified promptly of any incident that may involve bank connection tokens or Plaid-provided data.
• •Stripe will be notified of any incident that may involve subscription or billing information.
• •Our hosting and infrastructure providers will be engaged as necessary to support investigation and remediation.
• •Regulatory bodies will be notified where required by applicable law.

Once containment is complete and the investigation has established the scope of the incident, recovery steps are initiated to restore full service integrity:

• •Affected systems are rebuilt from clean, verified infrastructure images where necessary.
• •Data integrity is verified against encrypted backups before restoring to production.
• •Revoked credentials and access tokens are replaced with fresh, rotated versions.
• •Systems are returned to operation only after security team sign-off confirming the threat has been fully remediated.

Every confirmed security incident results in targeted remediation to close the vulnerability and reduce future risk:

• •The specific vulnerability or failure that caused the incident is patched, reconfigured, or replaced.
• •Related areas of the codebase or infrastructure are reviewed for similar weaknesses.
• •Security controls (monitoring rules, access policies, input validation) are strengthened based on incident findings.
• •Remediation steps are tracked to completion with defined owners and deadlines.

Every P1 and P2 incident results in a formal post-incident review:

• •A written incident report is produced documenting: timeline, root cause, impact, containment steps, user notifications, and remediation actions.
• •Incident reports are retained internally for a minimum of 3 years.
• •A post-incident review meeting is held to identify process improvements and prevent recurrence.
• •Key findings are incorporated into updated security policies and procedures.

Kleer Ledger treats every incident — however minor — as an opportunity to improve:

• •Lessons learned from incidents are used to improve monitoring, detection, and response capabilities.
• •This Incident Response Policy is reviewed at least annually and updated following any significant incident.
• •Response procedures are periodically tested through tabletop exercises and simulated incident drills.
• •We actively monitor security advisories, threat intelligence feeds, and industry disclosures to stay ahead of emerging threats.

To report a suspected security incident or vulnerability, contact us immediately at support@kleerledger.com.