Security contacts

Security contacts are the email addresses we use to reach you about security and privacy matters that affect your incident.io account, such as a security incident or a vulnerability that involves your data. Organizations on any plan can add security contacts. Organizations on paid Pro and Enterprise plans also get reminders to keep them up to date.

​

Adding security contacts

1. Go to Settings → Security and find Security contacts
2. Enter one or more email addresses
3. Click Save

We recommend using a mailing list, like your security team’s shared inbox, rather than an individual’s address. A mailing list keeps working when people change roles or leave. Security contacts don’t need an incident.io account.

​

Who can change security contacts

Changing security contacts requires the Manage security settings permission. Only the Owner base role includes it by default. See User roles and permissions for how roles work.

​

What we use security contacts for

When a security or privacy issue affects your account, we email your security contacts and your account owners. If your organization has no active account owners, we email everyone who has the Manage security settings permission instead.

​

Reminders

It’s important to keep your security contacts up to date, so we’ll send you periodic reminders to set them or check that they’re still correct. Reminders go to your account owners. If your organization has no active account owners, reminders go to everyone with the Manage security settings permission.

​

Updating your contacts restarts the clock

Whenever you save a change to your security contacts, we reschedule your next reminder from that date. For example, if you update your contacts on 1 March 2026, your next reminder is on 1 March 2027. If you change them again on 15 August 2026, that reminder moves to 15 August 2027. If you remove all your security contacts, we’ll send you a reminder in 6 months to add a new contact.

​

Plan changes

Reminders start when you move to a paid Pro or Enterprise plan. If you already added security contacts before you moved, your first reminder is a year later, to check they’re still correct. Moving between Pro and Enterprise doesn’t change your reminder schedule. If you move to a plan without reminders, they stop. Your security contacts stay in place.

​

FAQs