Incident Response Procedure

This Incident Response Procedure explains how Simple Software Development LLC responds to suspected or confirmed incidents affecting Edminhub, including security incidents, privacy incidents, availability incidents, data integrity concerns, unauthorised access, and suspected misuse of the platform.

The procedure is intended to support timely, proportionate, and documented responses to incidents while protecting schools, learners, parents, teachers, Edminhub, Simple Software Development LLC, and its directors, officers, employees, contractors, and affiliates.

This document is an operational procedure and does not create any warranty, guarantee, certification, or liability beyond what is expressly agreed in the applicable SaaS Subscription Agreement, Data Processing Agreement, or other written agreement with the school.

This procedure applies to incidents that may affect:

• the Edminhub application, infrastructure, databases, files, backups, integrations, email services, or administrative tools;
• school data, learner data, parent or guardian data, teacher data, staff data, or user account information processed through Edminhub;
• confidentiality, integrity, availability, authenticity, or auditability of information processed through Edminhub;
• the ability of schools to access or use the Edminhub service; and
• security or privacy concerns reported by schools, users, employees, contractors, hosting providers, or security tools.

This procedure does not apply to incidents caused entirely by school-controlled systems, school devices, internal school processes, or third-party services selected independently by the school, except where Simple Software Development LLC provides reasonable support at its discretion or under a written agreement.

Severity may be updated as more information becomes available. Initial classification should not be treated as a final legal or technical conclusion.

Suspected incidents should be reported promptly to Simple Software Development LLC using the designated contact channel.

Schools should include as much relevant information as possible, including:

• school name and contact person;
• date and time the issue was first noticed;
• affected user accounts, learners, classes, records, or features;
• screenshots, error messages, suspicious emails, or relevant examples;
• whether unauthorised access, data loss, or disclosure is suspected;
• steps already taken by the school, including password resets or user removal; and
• urgency and operational impact on the school.

Users and schools should not attempt to test, exploit, escalate, or publicly disclose a suspected vulnerability or incident without written approval from Simple Software Development LLC.

Incident communication must be accurate, proportionate, controlled, and based on verified information. Simple Software Development LLC may provide updates to affected schools where appropriate, but it will avoid speculation, legal conclusions, or admissions of liability.

In the event of a confirmed security incident affecting Customer Data or learner information, Simple Software Development LLC will take reasonable steps to notify the affected school where appropriate. Notification timelines may depend on the nature of the incident, applicable legal requirements, operational impact, the status of the investigation, and the information reasonably available at the time.

A notification may include, where appropriate and reasonably available:

• a general description of the incident;
• the approximate date or period of the incident;
• the categories of data or users potentially affected;
• containment and remediation steps taken or underway;
• recommended actions for the school or affected users;
• whether further updates are expected; and
• a contact point for follow-up questions.

The school remains responsible for determining whether it must notify parents, guardians, learners, staff, regulators, insurers, auditors, or other third parties, unless a written agreement or applicable law provides otherwise.

If an incident may trigger legal, regulatory, contractual, insurance, or law enforcement obligations, management should consider obtaining legal advice before issuing external statements or notices.

Simple Software Development LLC may cooperate with law enforcement, regulators, hosting providers, insurers, or professional advisers where legally required, commercially reasonable, or necessary to protect the platform, customers, learners, or company interests.

Nothing in this procedure should be interpreted as an admission that a reportable breach has occurred. Whether an incident is legally reportable depends on the facts, applicable law, contracts, and professional legal assessment.

Where reasonably possible, relevant evidence should be preserved. This may include:

• incident reports and support tickets;
• system, database, application, access, and audit logs;
• screenshots and error messages;
• affected account details and timestamps;
• configuration changes and deployment records;
• communication with the school, users, vendors, and advisers;
• containment, remediation, and recovery actions; and
• post-incident review notes and decisions.

Incident records are confidential company records. They may be shared with customers, regulators, insurers, or advisers only where approved by management, legally required, or commercially appropriate.

Schools play an important role in incident response. The school is responsible for:

For material incidents, Simple Software Development LLC may perform a post-incident review. The purpose is to identify lessons learned and improve controls, not to create admissions of liability or fault.

The review may consider:

• root cause or likely contributing factors;
• effectiveness of detection, containment, communication, and recovery;
• whether technical controls, monitoring, access controls, backups, or procedures should be improved;
• whether school guidance or user training should be updated;
• whether service agreements, privacy documents, or security documentation require updates; and
• whether follow-up actions should be tracked to completion.

Incident details, security weaknesses, system architecture, logs, technical findings, and customer-specific information are confidential. Schools and users must not publish or disclose incident details, vulnerabilities, screenshots, exploit methods, or security communications without prior written approval from Simple Software Development LLC, except where disclosure is legally required.

Only authorised representatives of Simple Software Development LLC may issue public statements about Edminhub incidents. Support staff, contractors, and technical personnel should not make public statements or legal conclusions unless specifically authorised.

Simple Software Development LLC will use reasonable efforts to respond to incidents affecting Edminhub. However, no system, procedure, backup, security control, or incident response process can guarantee complete prevention, detection, recovery, or elimination of all harm.

To the fullest extent permitted by applicable law, Simple Software Development LLC, its directors, officers, members, employees, agents, contractors, and affiliates shall not be liable for indirect, incidental, special, punitive, exemplary, or consequential loss arising from an incident, including loss of data, loss of profits, business interruption, reputational harm, regulatory penalties, third-party claims, or claims arising from the school's own use, misuse, configuration, administration, devices, users, networks, or third-party services.

Nothing in this procedure expands Simple Software Development LLC's liability beyond the limits agreed in the applicable SaaS Subscription Agreement, Data Processing Agreement, or other written contract with the school.

This procedure should be read together with:

• Edminhub Security and Privacy Statement;
• Edminhub SaaS Subscription Agreement;
• Edminhub Data Processing Agreement;
• Edminhub Child Data Protection Statement; and
• Edminhub Security Overview.

If there is a conflict between this procedure and a signed agreement, the signed agreement should prevail to the extent of the conflict, unless otherwise required by applicable law.

Simple Software Development LLC may review and update this Incident Response Procedure from time to time to reflect changes in Edminhub, hosting arrangements, legal requirements, security practices, operational experience, or lessons learned from incidents.

Updates may be communicated to schools through appropriate channels, including email, platform notices, updated documentation, or revised agreements where appropriate.

Questions about incident reporting, security, privacy, or Edminhub data protection may be directed to:

The following template may be used as a starting point for logging incidents: