1. About this document
- Last updated: 2026-11-09
- The current version is always available at https://www.inprox.pl/security
- A plain-text version is available at https://www.inprox.pl/rfc2350.txt
2. Contact information
| Field | Value |
|---|---|
| 2.1 Name | INPROX Sp. z o.o., security incident response team |
| 2.2 Address | ul. Narwicka 2G, 80-557 Gdańsk, Poland |
| 2.3 Time zone | Europe/Warsaw (CET, UTC+1; CEST, UTC+2 during summer time) |
| 2.4 Telephone | +48 608 206 721 (incident reports) |
| 2.5 E-mail | security@inprox.pl (incident and vulnerability reports); biuro@inprox.pl (general matters) |
| 2.6 Other communication | Support ticket form at pomoc.inprox.pl (for clients) |
| 2.7 Public keys and encryption | PGP key for security@inprox.pl, fingerprint: EC6D EE22 F9F8 7A2F 23B9 CF50 80B9 6FF7 1BB7 2E64, available at https://www.inprox.pl/pgp/security.asc. We recommend encrypting messages that contain sensitive information. |
| 2.8 Team members | The team is led by INPROX's Information Security Officer; it includes INPROX administrators and security specialists. |
| 2.9 Operating hours | Business days 8:00-16:00 local time. Outside these hours, urgent reports are taken by our on-call team at the number in 2.4, within the scope and response times defined in the client contract. Other reports are handled on the next business day. |
| 2.10 Client contact points | First, the client account manager named in the contract; for urgent matters, the telephone number in 2.4. |
3. Charter
3.1 Mission
We help INPROX clients prevent, detect and limit the impact of security incidents and restore normal operation of the systems we manage for them.
3.2 Constituency
INPROX clients with a contract covering IT services or security services, for the systems covered by the contract. Incident handling for other organisations is possible after a contract is signed.
3.3 Affiliation and authority
The team operates within INPROX Sp. z o.o. (KRS 0000466649). INPROX is a key entity under the Polish National Cybersecurity System Act and cooperates with the competent CSIRT. The team's authority in client systems arises from contracts with clients.
4. Policies
4.1 Types of incidents and level of support
We handle incidents affecting systems covered by a contract, in particular: account takeover, malware (including ransomware), phishing and e-mail fraud, unauthorised access, data leaks and availability attacks. We set priority according to the impact on the client's business; response times are defined in the client contract.
4.2 Co-operation, interaction and disclosure of information
- We treat information about incidents as confidential and share it only with the client concerned and, to the extent necessary, with CSIRT teams, authorities and suppliers, when required by law or by incident handling.
- We cooperate with CSIRT teams (CSIRT NASK, CSIRT GOV, CSIRT MON, sectoral CSIRTs), law enforcement, judicial authorities and services to the extent provided by law.
- We may share indicators of compromise (IoCs) that contain no data identifying clients with CSIRT teams and the security community.
4.3 Communication and authentication
Ordinary communication: e-mail and telephone. Sensitive information: e-mail encrypted with our PGP key (2.7) or a secure channel agreed with the client. We verify the identity of the reporter before sharing sensitive information or taking action in client systems (for example by calling back a number from the contract).
5. Services
5.1 Incident response
- receiving and assessing reports (triage), classification and prioritisation;
- coordination with the client, its suppliers and, when needed, CSIRT teams;
- limiting impact, removing the cause and restoring systems covered by the contract;
- securing evidence and initial post-incident analysis;
- supporting clients covered by the National Cybersecurity System Act in preparing information for their own CSIRT reports.
5.2 Proactive services
According to contract scope: security and availability monitoring, management of endpoint protection and firewalls, updates, security audits and assessments, training and phishing simulations, advice on security management.
6. Reporting incidents and vulnerabilities
You can report an incident or vulnerability by telephone or e-mail (section 2). Please include: the reporter's contact details, the organisation name, the time and description of the event, the systems concerned, actions already taken and available evidence (for example message headers, logs). Do not send passwords or large files without first agreeing how to transfer them.
6.1 Reporting vulnerabilities in INPROX systems and products
- Scope: INPROX domains, services and products (including Secrab and pomoc.inprox.pl). This does not cover INPROX clients' systems; please contact their owners.
- Reports: to the address in 2.5, preferably encrypted with the key in 2.7. We acknowledge receipt within 5 business days, keep you informed of progress and agree a publication date.
- Please do not exploit a vulnerability beyond what is needed to demonstrate it, do not violate data or service availability, and do not disclose details before the vulnerability is fixed.
- We will not take legal action against people acting in good faith in line with these rules.
- Where needed, CSIRT NASK acts as the national coordinator for coordinated vulnerability disclosure.
7. Threat information
Current information about cyber threats and protection is published by CERT Polska: https://cert.pl. You can also report an incident directly to CERT Polska: https://incydent.cert.pl.
8. Disclaimers
INPROX exercises due care in handling reports, but is not liable for the consequences of using information shared during incident coordination outside the scope of client contracts.
