Document Owner: CEO/CTO

Last Updated: October 21, 2025

Review Frequency: Annually or after major incidents

1. Purpose

This document defines Kino AI's process for detecting, responding to, and recovering from security and privacy incidents to minimize impact and ensure appropriate notification to affected parties.

2. Scope

This process applies to all security incidents affecting Kino AI systems, data, or operations, including:

• Unauthorized access to systems or data
• Data breaches or exposure of sensitive information
• Malware or ransomware infections
• Denial of service attacks
• Lost or stolen devices containing sensitive data
• Suspected or confirmed privacy violations
• Social engineering or phishing attacks that succeed

3. Incident Response Team

Primary Contact: CEO/CTO (Lucas Igel)

Secondary Contact: Lead Engineer (Wesley Block, Ian Watts)

Given Kino AI's small team size, the CEO/CTO has primary responsibility for incident response, with support from engineering team members as needed.

4. Incident Detection

4.1 Detection Methods