SECURITY
Breach notification policy.
Last updated · March 22, 2026Control owner · Security EngineeringDocument · /security/breach-notification
Overview
BroadNet notifies affected customers within 72 hours of confirming a breach involving their data. Regulators are notified per applicable law. Public disclosure is coordinated with affected customers.
§01
Definitions
Security terminology used on this page is defined below. Cryptographic and incident-response terms follow NIST SP 800-53 Rev. 5 and ISO/IEC 27001:2022 vocabularies where applicable.
Quick reference
- Data residency
- The geographic region in which a customer’s data is stored at rest. Distinct from data sovereignty.
- Sub-processor
- A third party engaged by BroadNet to process personal data on behalf of customers.
- Confirmed breach
- A security event verified by Security Engineering as involving unauthorised access to or loss of customer data — triggering the 72-hour clock.
- Encryption at rest
- AES-256-GCM applied to all persistent storage. Keys managed via HSM-backed KMS with quarterly rotation.
Questions?
Reporting a vulnerability, requesting a SIG/CAIQ, or asking about a control? Our security team triages within one business day.
security@broadnet.meFor non-security correspondence, email legal@broadnet.me.
Related documents