Security incident response

Training programmes trust adept with information about their trainees. This page summarises how Adept Training Platforms Ltd responds if something goes wrong. The full plan, including its technical procedures, is an internal document and is available to customers and their information governance teams on request.

1. What we treat as an incident

Any event that may affect the confidentiality, integrity or availability of the service or the data in it. That includes a compromised account, access by someone who should not have it, information sent to the wrong person, data lost or changed in error, and an outage.

2. How we find out

• An audit log of changes made in the service, which cannot be edited or deleted.
• Monitoring of the platform for errors, unusual activity and unusual sign-ins.
• Reports from the people who use the service.

3. How we respond

Every incident follows the same steps: record and triage it, contain it, assess what was affected and whose data it was, recover, notify the people who need to know, and review what happened.

• Critical, such as confirmed unauthorised access to many records: immediate response.
• High, such as one compromised account: within hours.
• Medium, such as an email sent to the wrong recipient: the same working day.
• Low, where nothing was affected: handled as routine, and still recorded.

Data changed or deleted in error can be restored from point-in-time recovery covering the previous seven days, or from scheduled backups.

4. Who we tell, and when

• Our customers. The training programme whose data is affected is the data controller. We tell them promptly, with what we know, what we have done and what we recommend.
• The Information Commissioner’s Office. A personal data breach that is likely to put people’s rights and freedoms at risk is reported within 72 hours of our becoming aware of it.
• The people affected. Where a breach is likely to put individuals at high risk, they are told without undue delay.

Every incident is recorded, whether or not it has to be reported.

5. Afterwards

Within five working days of an incident being resolved we complete a written review: the root cause, what worked, what did not, and the changes we will make. Those changes feed into our data protection impact assessment and into the plan itself.

6. Reporting a security concern

If you believe you have found a security weakness in adept, or you have seen something that does not look right, please tell us at support@adept-platforms.com. We read every report, we will acknowledge yours, and we will not take action against anyone who reports a concern in good faith. Please do not access, change or remove data that is not your own while looking into it. The same contact is published in machine-readable form at the app's security.txt file.

Omar Jundi, Director, Adept Training Platforms Ltd · 21 September 2026