GoRefer Trust Center
Incident Response
Updated October 2026
About this page. This page describes how GoRefer works today. It is not an independent audit or a contractual service level. For questionnaire answers, or for documents we share under NDA, make a request through the Trust Portal.
GoRefer maintains a written incident response plan. This page explains how we find out about security incidents, what we do about them and how we tell your firm.
How We Notify Your Firm
Updated October 2026
Our notice commitment
If we confirm unauthorized access to your firm's client information, we will notify your firm's administrators without unreasonable delay, and no later than 72 hours after we confirm it, with what we know, so your firm can meet its own notice duties.
How you hear from us
By email to the administrators on your firm's GoRefer account
We send updates as we learn more
Your firm's own duties
Your firm decides whether it must notify its clients, state agencies or the FTC
The FTC Safeguards Rule requires notice to the FTC within 30 days of discovering that unencrypted information of 500 or more consumers was acquired without authorization
Report data theft to your IRS Stakeholder Liaison and to your state tax agencies
How We Respond
Updated October 2026
1. Find out
Error monitoring with Sentry
Our security audit logs
Reports from customers and security researchers
2. Contain and fix
Stop the unauthorized access, for example by revoking credentials and sign-in sessions
Find and fix the cause
Notify affected firms as described above
3. Review
Within 7 days of resolving an incident, we write up what happened and what we changed, and share the findings with the firms it affected.
Report a Security Incident
Updated October 2026
If you believe you have found a security vulnerability or know of a security incident affecting GoRefer, please report it right away using the form below. Our acknowledgement target is 24 hours.