Platform Incident
Response Policy

The objectives of this policy are to:

• ensure timely response to platform incidents
• minimise operational disruption
• protect users, merchants, and platform data
• support regulatory and legal compliance
• maintain trust in the Aulax ecosystem.

This policy applies to incidents affecting:

• the Aulax digital platform and mobile applications
• APIs and platform integrations
• automated retail or checkout systems
• data processing systems and infrastructure
• user and merchant platform interactions.

Incidents may originate from technical failures, cyber threats, fraudulent activity, or operational disruptions.

Aulax provides digital infrastructure that enables interactions between independent users and merchants.

While Aulax maintains systems designed to protect platform security and reliability, merchants remain responsible for their own operational practices, regulatory compliance, and the goods or services they provide.

Platform incident management does not transfer responsibility for merchant operations to Aulax.

Platform incidents may include, but are not limited to:

Security Incidents

• unauthorised access to systems
• attempted exploitation of platform vulnerabilities
• malware or cyberattacks.

Data Protection Incidents

• personal data breaches
• unauthorised disclosure of information
• data loss or corruption.

Where relevant, incidents involving personal data are handled in accordance with the Aulax Data Protection & Security Policy and applicable data protection legislation.

Platform Infrastructure Failures

• system outages
• API disruptions
• infrastructure or cloud service failures
• automated checkout system failures.

Fraud or Abuse Incidents

• fraudulent transactions
• fake merchant accounts
• manipulation of platform systems
• coordinated abuse or bot activity.

Safety Incidents

• harassment or harmful behaviour on the platform
• unsafe merchant practices
• incidents affecting the safety of users or merchants.

Platform incidents may be detected through:

• automated monitoring systems
• security and fraud detection tools
• system log analysis
• reports from users or merchants
• internal operational monitoring
• notifications from third-party service providers.

Aulax may analyse system logs, behavioural signals, and transaction patterns to detect potential incidents.

Incidents may be reported by:

• users
• merchants
• employees or contractors
• security researchers or third parties.

Reports may include suspected fraud, safety risks, technical failures, or policy violations.

Incident reports may be submitted through Aulax support channels or designated security reporting channels.

When an incident is identified, Aulax may initiate the following response process.

Identification

The incident is assessed to determine its nature, scope, and potential impact.

Containment

Actions may be taken to limit the impact of the incident, including:

• restricting system access
• isolating affected systems
• disabling compromised accounts
• suspending affected platform features.

Investigation

Aulax may investigate the cause of the incident through:

• system log analysis
• account activity review
• security monitoring tools
• coordination with relevant service providers.

Resolution

Corrective actions may be implemented to resolve the incident, including:

• patching vulnerabilities
• restoring system functionality
• updating system configurations.

Recovery

Platform services may be restored once systems are confirmed to be secure and operational.

Post-Incident Review

Aulax may conduct a review to:

• identify root causes
• improve detection mechanisms
• strengthen operational safeguards.

Where appropriate, Aulax may communicate incident information to:

• affected users or merchants
• third-party service providers
• regulatory authorities where required by law.

Communications will be provided in accordance with legal obligations and operational considerations.

Where required by law, Aulax may notify relevant regulatory authorities regarding certain incidents.

For example, personal data breaches may be reported to the Information Commissioner’s Office (ICO) where required under applicable data protection laws.

Certain platform services rely on third-party infrastructure or service providers including:

• cloud hosting providers
• payment service providers
• identity verification services.

Where incidents involve third-party systems, Aulax may coordinate response and remediation activities with the relevant providers.

Aulax encourages responsible disclosure of potential security vulnerabilities.

Individuals who identify security vulnerabilities are encouraged to report them through designated security contact channels.

Aulax will review reported vulnerabilities and take reasonable steps to investigate and address legitimate issues.

Security testing that disrupts platform operations, accesses personal data without authorisation, or violates applicable laws remains prohibited.

Aulax maintains internal records of significant incidents, which may include:

• incident description and timeline
• systems affected
• response actions taken
• resolution measures
• lessons learned.

Maintaining such documentation supports platform security improvements and compliance obligations.

Aulax continuously reviews its incident response procedures to address:

• emerging security threats
• technological developments
• operational improvements
• evolving regulatory requirements.

Procedures may be updated periodically to strengthen platform resilience.