This policy covers the hosted Ongoing Science Drawings pilot. It provides a reporting route for suspected unauthorised access, exposed drawings, account compromise, data loss or vulnerabilities.
Report a concern
Email support@ongoingscience.com with the subject “Drawings security incident”. Include the affected service URL, approximate time and time zone, a concise description and safe reproduction steps. Do not send passwords, session tokens, client secrets or copies of other people’s drawings. Redact personal data in screenshots. For sensitive evidence, ask us to arrange a suitable transfer method first.
We treat reports confidentially and will not take legal action against people who report in good faith, do only what is needed to show the problem, do not access, change or keep other people’s data, and give us reasonable time to fix the issue before telling others. This is a statement of our practice for the pilot, not a licence for intrusive testing.
Response process
The service operator reviews reports, assesses impact and takes proportionate containment measures. These may include restricting access, revoking affected sessions, disabling a feature or temporarily taking the service offline. Relevant logs and evidence are preserved where needed for investigation.
The operator investigates the cause, coordinates with hosting or identity providers where relevant, applies and verifies corrective measures, and informs affected participants or institutional contacts as appropriate. Personal-data breaches are assessed for notification duties under applicable law, including notification to the competent authority within 72 hours of awareness where Article 33 GDPR requires it, and notification to affected people where Article 34 requires it.
Recovery and follow-up
Before restoring normal access, the operator checks the affected permissions and service behaviour. Recovery from a backup may lose recent changes and can restore earlier access settings; these must be reviewed before reopening the service. Findings are used to improve safeguards and operating procedures.
Availability of support
This pilot does not provide a staffed 24-hour security desk or a guaranteed response time. Email is the reporting channel. Do not continue accessing exposed data after discovering a problem, and do not publicly disclose other users’ information. This policy does not authorise intrusive testing.