> ## Documentation Index
> Fetch the complete documentation index at: https://docs.incident.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security contacts

> Make sure the right people hear from us when a security or privacy issue affects your account.

Security contacts are the email addresses we use to reach you about security and privacy matters that affect your incident.io account, such as a security incident or a vulnerability that involves your data.

Organizations on any plan can add security contacts. Organizations on paid Pro and Enterprise plans also get reminders to keep them up to date.

## Adding security contacts

1. Go to [**Settings → Security**](https://app.incident.io/~/settings/security#security-contacts) and find **Security contacts**
2. Enter one or more email addresses
3. Click **Save**

We recommend using a mailing list, like your security team's shared inbox, rather than an individual's address. A mailing list keeps working when people change roles or leave. Security contacts don't need an incident.io account.

### Who can change security contacts

Changing security contacts requires the **Manage security settings** permission. Only the Owner base role includes it by default. See [User roles and permissions](/admin/user-permissions) for how roles work.

## What we use security contacts for

When a security or privacy issue affects your account, we email your security contacts and your account owners. If your organization has no active account owners, we email everyone who has the **Manage security settings** permission instead.

## Reminders

It's important to keep your security contacts up to date, so we'll send you periodic reminders to set them or check that they're still correct. Reminders go to your account owners. If your organization has no active account owners, reminders go to everyone with the **Manage security settings** permission.

| Situation | When we remind you |
| - | - |
| You've just moved to a Pro or Enterprise plan | 7 days later, if you haven't added security contacts yet |
| You don't have any security contacts | Every 6 months, until you add some |
| You have security contacts | Once a year, to check they're still correct |

### Updating your contacts restarts the clock

Whenever you save a change to your security contacts, we reschedule your next reminder from that date. For example, if you update your contacts on 1 March 2026, your next reminder is on 1 March 2027. If you change them again on 15 August 2026, that reminder moves to 15 August 2027.

If you remove all your security contacts, we'll send you a reminder in 6 months to add a new contact.

### Plan changes

Reminders start when you move to a paid Pro or Enterprise plan. If you already added security contacts before you moved, your first reminder is a year later, to check they're still correct.

Moving between Pro and Enterprise doesn't change your reminder schedule. If you move to a plan without reminders, they stop. Your security contacts stay in place.

## FAQs

<AccordionGroup>
  <Accordion title="Do I need to reply to a reminder if my contacts are still correct?">
    Nope, you're all set! We'll remind you again in a year.
  </Accordion>

  <Accordion title="Why did my account owners get the reminder instead of my security contacts?">
    Reminders go to the people who can change your security contacts. By default, that's your account owners. Your
    security contacts only hear from us about security and privacy matters.
  </Accordion>

  <Accordion title="Can I add more than one security contact?">
    Yes. Add as many email addresses as you need. We'll email all of them, along with your account owners.
  </Accordion>
</AccordionGroup>