Breach Response

Effective July 19, 2026.

This page states, in binding detail, how Digital Empire Holdings LLC responds to a personal-data breach affecting Citation Safe. It exists to satisfy the notification requirements of the 46 U.S. states plus the District of Columbia, Puerto Rico, Guam, and the U.S. Virgin Islands that have personal-data breach statutes, and to give our customers an unambiguous timeline and template rather than a vague “we will notify you promptly” promise.

1. What qualifies as a personal-data breach

Under our data model, a “personal-data breach” is the unauthorized access to, acquisition of, disclosure of, or destruction of any of the following, whether by an external actor or by an internal misconfiguration:

• Account email address associated with a Citation Safe account.
• The cryptographic hash of a submitted document (SHA-256 hash only — not the document content).
• Verification history metadata (citation text, verdict, timestamp, subscription tier).
• Stripe customer identifier (billing_accounts.stripe_customer_id) or the associated Stripe-processor-hosted card metadata (which we do not store; Stripe holds full card data).
• Any personally identifiable information a user voluntarily entered in a support conversation or dispute description.

What is not held here (and therefore cannot breach): Social Security numbers, driver’s license numbers, financial account numbers, Protected Health Information (PHI), and full submitted document text. We reject PHI at the door per Terms §1c; we do not persist raw document text (only the SHA-256 hash) per our Privacy Policy and Retention Schedule; and full card data is held at Stripe under their PCI-DSS scope, not ours.

2. Detection channels

We monitor for breach indicators through the following automated and human channels. Each one has an alert path that reaches a human on-call within minutes:

• Sentry — application-error monitoring on the Next.js runtime and the citeguard-app API surface. Unusual error volume, auth-failure spikes, or errors referencing personal-data columns page the on-call engineer.
• Supabase Row Level Security (RLS) — every table with user-scoped data has RLS enforced (see migration 0072). A RLS-violation attempt is logged and surfaced to citeguard.rls_denies_last_24h. See /security for our RLS posture.
• PostHog session and event analytics — unusual patterns (e.g., a single IP hitting hundreds of report URLs, a spike in export requests, a large batch of failed-auth events on a single account) trigger internal alerts.
• Watchdog alerts — citeguard.watchdog_alertsscheduled tasks catch signal-level anomalies (Stripe webhook-verify failures, unusual Stripe API-key usage, unexpected admin-panel access outside working hours).
• External reports — the security disclosure channel at security@citationsafe.com, monitored the same day.

3. Response timeline

Within 72 hours of detection: we complete an internal breach assessment. The assessment identifies (a) what data was affected, (b) how many accounts, (c) the root cause, (d) the containment status, and (e) whether the breach meets a state-law notification threshold. The assessment is written to citeguard.breach_response_log and reviewed by Digital Empire Holdings LLC’s principal.

Within 30 days for confirmed high-risk breaches: we notify (i) every affected user by direct email to the address on their account, (ii) the state Attorney General of every state in which we have an affected user resident, in the form and by the channel each state requires, and (iii) any applicable consumer reporting agency where state law requires it (e.g., California, Massachusetts). Thirty days is our binding commitment because it satisfies every applicable state statute; several states allow longer, but our public promise is 30 days.

Ongoing: we post a summary to /security (redacted of any information that would enable further attack) once the underlying cause has been remediated and the notification wave is complete.

4. Notification template

The following template is what an affected user receives by email. The subject line and body are pre-drafted so we cannot delay notification arguing over language:

5. Logging

Every breach investigation — whether it results in notification or is determined not to meet the threshold — is logged to the citeguard.breach_response_log table (see migration 0073). The log preserves the detection time, the assessment outcome, the notification-threshold decision with reasoning, and, where notification is sent, the list of affected accounts and the state AGs notified. The log is append-only and RLS-restricted to Digital Empire Holdings LLC staff.

6. What this page is not

This is a breach-response commitment, not a warranty against breaches. No service, ours included, is unbreachable. What we guarantee is the response timeline and the notification protocol — not that a breach will never occur. Our security controls are described honestly at /security.

7. Contact

Suspected security issue: security@citationsafe.com. Legal notices: legal@citationsafe.com. Digital Empire Holdings LLC, 30 N Gould St Ste N, Sheridan, WY 82801.