1. Report a concern
If you believe you have found a security issue affecting an Échelle website or a project workflow, email team@echelleventures.com with the subject “Security report”. Include the affected URL, a concise description, steps to reproduce, and a safe way to reach you. Please avoid sending real client or student data in the first message.
If a report involves immediate exposure of personal information, say so in the subject line so it can be triaged quickly. A dedicated security inbox and response-time commitment should be added once an owner is assigned.
2. Responsible research
Research should be limited to systems Échelle owns or explicitly authorises for testing. Do not access other people’s data, disrupt service, use social engineering, or test third-party systems such as Google Forms, Netlify or client infrastructure without their permission. Stop if you encounter sensitive data and tell us privately.
This preview does not grant permission to test any system or promise a legal safe harbour. A final disclosure policy should set scope and authorisation with counsel and the technical owner.
3. How information is protected
The current public Privacy Policy describes HTTPS, security headers and no website accounts. Those are website-level statements, not a complete description of how client material is protected during projects. Before publishing a full security page, verify access controls, MFA, device standards, file-sharing permissions, backups, incident ownership and deletion practices.
Working rule for project teams: give each consultant only the access needed for their assignment; use approved accounts and storage; never paste client data into an AI tool without written permission; remove access at project close.
4. Incidents & updates
A confirmed incident should have an internal owner, a record of what happened and who was affected, containment steps, and an assessment of any notification duties. The outward-facing policy should explain how people can ask about their own data without making unverified guarantees about notification timeframes.
For privacy requests, see the existing Privacy Policy.
← All trust & terms pages · Questions: team@echelleventures.com