Business Continuity & Resilience Statement

Service Resilience & Availability

To support continuity, Impressionwise employs:

• Redundant infrastructure and monitoring pipelines to avoid single points of failure
• Graceful degradation, ensuring partial intelligence remains available rather than complete outages
• Data protection controls, including encrypted storage and regular backups
• Automated health monitoring and alerting for rapid issue detection

Data Integrity

Impressionwise protects customer data through layered security and resilience controls designed to prevent unauthorized access, loss, or corruption.

Encrypted Data at Rest and in Transit. All customer data is encrypted both when stored and while being transmitted, ensuring it remains protected from unauthorized access at all times.

Real-Time Replication for Critical Databases. Critical systems continuously replicate data across secure environments to reduce downtime and prevent data loss during service disruptions.

Point-in-Time Recovery (PITR). We maintain the ability to restore systems to a specific moment in time, enabling rapid recovery from accidental changes or data corruption.

Immutable Off-Site Backups. Backups are stored in tamper-resistant, off-site locations, protecting data from deletion, alteration, or ransomware-related threats.

Incident Management & Response

Impressionwise maintains a structured incident response and escalation process to ensure timely resolution, clear accountability, and transparent customer communication during service-impacting events.

Impressionwise maintains a structured incident response process that includes:

• Rapid detection and classification of service-impacting events
• Defined escalation paths and response ownership
• Continuous internal coordination until resolution
• Post-incident reviews to improve future resilience

In the event of a material service disruption:

• Impressionwise will investigate and take reasonable steps to restore service promptly.
• Status updates may be provided via public status pages, or as-described communication channels within this statement.
• Estimated restoration times are provided on a best-effort basis and may change as new information becomes available.

Incident Severity Levels & Escalation

Incidents are classified based on customer impact to prioritize response and recovery efforts.

Monitoring or Alerting Unavailable. Critical incidents that impair core monitoring or alerting capabilities are addressed immediately.

Partial Data Loss or Delays. Issues affecting data completeness or timeliness receive a response within 30 minutes.

Degraded Performance. Performance degradation without full service loss is addressed within two hours.

Non-Critical Issues. Minor or cosmetic issues are addressed during the next business day.

Incident Workflow

All incidents follow a consistent, documented response process.

Detection and Classification. Automated monitoring and internal reporting identify incidents and assign an appropriate severity level.

Incident Commander Assigned. A designated Incident Commander coordinates response efforts and maintains accountability throughout the incident.

Customer Impact Assessment. The scope and impact on customers are assessed to guide remediation and communication priorities.

Technical Remediation. Engineering teams implement corrective actions to restore service and prevent recurrence.

Customer Communication. Timely, transparent updates are provided through appropriate communication channels during significant incidents.

Post-Incident Review (RCA). After resolution, a root cause analysis is conducted and corrective actions are documented to strengthen future resilience.

Incidents are handled with a focus on accuracy, speed, and minimizing customer impact.

Customer Communication During Incidents

We recognize that timely and transparent communication is critical during service disruptions.

During significant incidents, customers may receive updates via:

• Our public status page
• Email-based notifications
• Integrated messaging channels

Our communications clearly describe:

• What is affected or scope of impact
• What is not affected
• Current status and next steps

Recovery Objectives

Impressionwise defines recovery (RTO,RPO) objectives for critical system components to ensure timely restoration of services and minimize data loss during disruptions.

Alerting Systems. Alerting capabilities are restored within 30 minutes, with near-zero data loss to ensure customers receive timely notifications of deliverability and reputation events.

Monitoring, Scoring & Intelligence Pipelines. Core monitoring pipelines are recovered within one hour, with data loss limited to no more than 15 minutes.

Batch Verification Processing. Used for large list uploads and asynchronous processing are recovered within one hour, with data loss limited to no more than 30 minutes.

API’s. Customer-facing API’s are restored within 30 minutes, ensuring continuity for integrations, with near-zero data loss.

Dashboards, Analytics & Reporting. Customer dashboards, analytics and reporting are restored within two hours, with data loss limited to one hour, providing continued visibility into service insights.

The above recovery objectives do not apply to issues caused by factors outside Impressionwise’s reasonable control, including customer configuration errors, third-party network failures, or force majeure events.

Third-Party Dependency Management

Impressionwise relies on select external infrastructure providers to deliver our services.

To reduce dependency risk, we:

• Monitor third-party service health
• Use multiple providers where feasible
• Maintain fallback and substitution strategies
• Regularly review vendor performance and reliability

Security & Data Integrity

Business continuity is tightly integrated with our security program. During disruptions:

• Customer data remains protected using encryption and access controls
• Changes to production systems follow defined authorization procedures
• Security monitoring continues without interruption
• Principle of least privilege maintained
• Evidence preservation for audit

Review, Testing & Validation

Our continuity program is actively tested and maintained through:

• Regular scenario-based exercises
• Simulated vendor and infrastructure outages
• Post-incident reviews and documented improvements
• BCP reviewed annually
• Updated after major incidents
• Changes approved by executive leadership
• Version-controlled documentation

This ensures our continuity controls remain effective as our platform and ecosystem evolve.

Human Continuity & Knowledge Management

Impressionwise ensures service continuity by reducing reliance on any single individual through structured staffing, documentation, and knowledge-sharing practices.

On-Call Rotation with Cross-Training. Operational responsibilities are shared across trained team members through an on-call rotation, ensuring rapid response even if key personnel are unavailable.

Documented Runbooks. Critical operational procedures are documented and maintained to support consistent, repeatable responses during incidents.

Blacklisting Incidents. Runbooks define standardized steps for detection, investigation, mitigation, and recovery from IP or domain blacklisting events.

ISP Policy Changes. Procedures outline how mailbox provider policy updates are identified, assessed, and communicated to customers with actionable guidance.

Data Ingestion Failures. Runbooks detail how data pipeline issues are diagnosed, remediated, and validated to restore accurate intelligence quickly.

No Single Individual Holds Exclusive Operational Knowledge. Knowledge is distributed across the team to prevent single points of failure and ensure continuity regardless of staff availability.

Our Philosophy

Service provision is dynamic by nature. Outages, policy shifts, and events are inevitable.

Our goal is not to promise the impossible - but to ensure that Impressionwise remains a dependable source of service availability, and transparency when our customers need it most.

Contact & Disclosure

Security concerns or vulnerability reports may be submitted to operations@Impressionwise.com.

Disclaimer: This document is provided for informational purposes only and does not constitute a contractual commitment. Specific security controls may vary by service offering and contractual agreement.

Questions? If you have questions about our continuity program or require additional documentation for vendor review, please contact operations@Impressionwise.com.