# Proposed evidence handling and customer service schedule

15 October 2026 • DRAFT FOR OPERATIONAL ADOPTION

This schedule supplies concrete proposed defaults. It does not state that QILAHK currently implements them, replace an executed agreement, or represent a complete jurisdiction-specific privacy notice. Operational facts and applicable obligations must be verified before publication.

## Proposed evidence handling schedule

| Topic | Proposed rule | Evidence required before release |
|---|---|---|
| Collection | Collect scoped device posture and necessary contact information; exclude passwords, private keys, recovery keys and tokens | Current collector field inventory and transfer inspection |
| Purpose | Use evidence to scope, perform and support the agreed assessment and credential lifecycle | Data-flow map, contractual purpose and access review |
| Access | Named, least-privilege roles; MFA for privileged access; periodic review; logged access | Role matrix and successful access-control tests |
| Transfer and storage | Approved encrypted transfer and encrypted storage | Verified architecture/configuration and provider records |
| Residency | Disclose primary storage and backup countries before evidence transfer | Actual hosting, database, backup and support locations |
| Providers | Maintain list of subprocessors, purposes, locations and contractual safeguards | Validated provider register |
| Raw evidence | Delete 90 calendar days after engagement closure unless a different period is agreed or preservation is required | Working retention job and deletion test |
| Decision records | Retain minimum supporting decision records for 24 months after credential expiry or engagement closure, whichever is later | Data minimization review and retention test |
| Backups | Retained deleted data ages out within 35 days; restrict recovery use and reapply deletions after restore | Backup lifecycle and restore test |
| Customer export | Supply agreed customer evidence and reports through verified secure access within 10 business days of a valid request | Export test with identity verification |
| Deletion requests | Acknowledge within 2 business days; process within 30 calendar days subject to applicable requirements and justified holds | Request workflow and deletion receipt |
| Public registry | Publish only agreed minimal subject/scope/status fields; preserve essential lifecycle history | Publication consent and disclosure test |
| Incidents | Notify the customer contact without undue delay after confirming an incident affecting customer evidence; agree additional timing in the contract | Incident exercise and contact roster |

All durations are proposals, not statements of legal minimums. A preservation hold must have a documented basis, owner, access restriction and review date. Do not promise deletion of necessary public lifecycle records without resolving history and accountability requirements.

For the public privacy notice, confirm the legal entity/controller, contact details, actual data categories, sources, purposes, applicable legal bases, recipients, international transfers, retention rationale, user rights, request process, complaint route, cookies and policy effective date. Do not insert guessed addresses, locations, providers or compliance claims.

## Proposed service schedule

| Service issue | Proposed customer-facing commitment | Activation condition |
|---|---|---|
| Assessment start | Start after authorization, agreed scope, necessary access and payment conditions are satisfied | All prerequisites recorded |
| Standard turnaround | Target initial report within 10 business days after complete evidence is accepted | Capacity confirmed in engagement |
| Missing evidence | Explain missing items and pause the delivery clock with notice | Evidence checklist and receipt record |
| Support | Acknowledge ordinary requests within 2 business days; business hours and timezone stated in scope | Staffed inbox and coverage roster |
| Remediation | Guidance included only as listed in scope; implementation requires separate authorization | Explicit inclusions and exclusions |
| Reassessment | One review of corrected evidence submitted within 30 days included for the same unchanged scope | Price model supports this inclusion |
| Scope changes | Explain effect on price and timing and obtain agreement before extra work | Change record |
| Cancellation | Before work starts, refund the assessment service fee; after work starts, refund the unperformed portion using agreed milestones | Billing and milestone accounting validated |
| Monitoring renewal | Disclose billing interval, actual amount, renewal date and cancellation method before checkout | Processor configuration verified |
| Monitoring cancellation | Stop the next renewal when cancelled before the billing cutoff; state access-end date and applicable prorating terms | Successful cancellation test |
| Failed assessment | No favorable result guaranteed; explain review work performed and applicable fees | Separate technical and commercial decisions |
| Offboarding | Agree export, agent removal, entitlement closure, evidence retention and credential status | Tested offboarding checklist |

Publish actual support hours, escalation route, billing cutoff and prorating rules only after validation. Distinguish a response target from a resolution guarantee. State emergency coverage accurately; do not imply a 24/7 incident-response service unless contracted and staffed.

## Platform and deployment facts to publish

Create a verified support matrix with OS versions/builds, architecture, privileges, outbound destinations, evidence fields, collection frequency, signed package hash, signer, release version, update method, resource impact, bulk deployment and removal steps. Mark untested entries as unverified. The public homepage currently identifies Windows availability and describes mobile release availability as pending; do not promote mobile production readiness without a signed, tested release.

## Adoption record

Required decision owners: operations (capacity and workflow), technical lead (implemented safeguards), commercial owner (price/refund policy), privacy/legal reviewer (actual notice and applicable terms), authorized company approver (effective date). Record approval, implementation evidence and policy version before replacing live legal or service pages.