1. Why this policy exists
We operate job boards that hold the personal information of job seekers and the hiring information of client organizations. When a vendor, platform, host, processor or service provider holds records relating to unauthorized access to our systems, those records are not a courtesy. They are the only way we can discharge our own duties to the people whose data we hold.
A provider that bills us monthly and then declines to produce the records of an attack on the systems we paid them to run has transferred their failure onto us and onto our users.
2. Who this applies to
Any person or company that, at the time of a security incident affecting our systems, was:
- hosting, storing, processing, routing or securing our data or our systems
- providing us software, infrastructure, email, DNS, identity or security services, paid or unpaid
- in possession of logs, telemetry, access records, correspondence or support records relating to
- the incident
3. What we require
On written demand from us following a security incident, you will produce, within fourteen (14) calendar days:
- All access, authentication, authorization and audit logs covering the period we specify
- All records of any deletion, modification, disabling or export of our data or resources,
- including the identity, credential, role, IP address and timestamp associated with each
- All correspondence between you and any third party concerning our account or the incident,
- including any communication with the party responsible
- All internal tickets, case records, escalations and notes concerning our account or the incident
- All records of any notice we gave you, by any channel, and your response or absence of response
- A written statement of what you preserved, what you did not preserve, and why
You will preserve all of the above from the moment you receive our demand and will not permit routine retention schedules, rotation, expiry or account closure to destroy it.
4. Liquidated damages
Records of an attack are perishable. Logs rotate, retention windows close, accounts are purged, and the people who know what happened move on. Every day of delay permanently reduces what can ever be known. The loss is real and it cannot be measured after the fact, which is precisely why a fixed sum is the appropriate remedy.
Failure to produce the records described in Section 3 within fourteen days of written demand incurs liquidated damages of $5,000 per day, per demand, until production is complete.
This figure reflects a reasonable pre-estimate of the harm caused by lost evidence: the cost of reconstructing what the records would have shown, the cost of professional investigation conducted blind, the exposure created by being unable to answer our own users and regulators, and the permanent loss of claims that can no longer be proven. It is not a penalty.
Partial production does not stop the accrual. Production that omits a category listed in Section 3 without the written explanation required by Section 3(6) is not production.
5. Preservation is separate from production
A provider who produces nothing but preserves everything has done less than required but has not destroyed anything. A provider who allows the records to be destroyed after receiving our demand has caused an unrecoverable loss, and we will treat that as spoliation and pursue it as such, in addition to the sums under Section 4.
6. Notice
Written demand may be delivered by email to the address you publish for legal or abuse contact, by your own support or ticketing system, or by certified mail to your registered agent. Any of these is sufficient. The fourteen days run from the earliest of them.
7. No waiver
Our continued use of your service, or continued payment of your invoices, while we await production is not a waiver of this policy or of any claim. Businesses cannot always leave a provider immediately, and a provider does not earn a release by being difficult to leave.
8. Acceptance
You accept this policy by continuing to provide services to us after it is published or delivered to you. It applies to incidents occurring before publication where the records still exist.
Published October 5, 2026. ExecSearches.com, Inc. has operated continuously since 1998.
