01 — INTAKE
Log what happened
Data classes, affected populations by state, and the discovery date — the one date every clock in this incident pins to.
Data breach notification
See how it works
The worst day of the year, run at 62 bpm.
Intake, the 50‑state obligation map, deadline clocks, and notice letters — under one clock your counsel can sign off on, every time.
Illustrative · sample incident
14
days on the
soonest clock
soonest clock
§ version pending counsel release — every citation shown, never a bare verdict
The honest question
“We're mid‑breach — this is exactly when we call our lawyer, not when we buy software. And if the map is wrong, we're the ones the regulator fines.”
Your counsel makes the call. BreachDuty makes sure it happens on time, on the record.
01
What the breach coach uses
BreachDuty doesn't replace counsel — it's what your breach coach or IR firm runs on, and can white‑label under their own name.
02
Versioned at the moment that matters
Every statute is effective‑date‑versioned and counsel‑validated at release; every deadline computes against the version in force at discovery.
03
A citation, never a verdict
Every obligation shows its basis. When a statute amends, the change‑notice ships as a product feature — not a surprise.
How it works
Intake to close, one clock the whole way.
Four steps, in order. Nothing moves off the clock, and nothing ships without a citation attached.
02 — ATLAS
Watch the map light up
Every obligation maps to a cited basis. States you owe glow; the rest stay quiet — the quiet is half the answer.
03 — LETTERS
Notices draft themselves
Per state, per recipient class — individuals, AG, media. Counsel reviews and approves before anything goes out.
04 — CLOSE
Seal the record
A tamper‑evident export of every step, timestamp, and actor — ready for an auditor, a regulator, or your own GC.
The signature moment
Every state you owe. Every state you don't.
Finish intake and the country tells you the truth: the states with a running clock glow ice‑bright, a regulator overlay outlines where a copy is owed, and everything else goes quiet. The screenshot a prospect forwards is the lit atlas — the sentence they say next is the one that matters.
The full state‑by‑state atlas — cited, versioned, counsel‑validated — ships with the statute corpus.
Glow = clock running
A fact, not a color choice. Never rendered as an alarm — urgency here is light, not red.
Outline = regulator overlay
An AG copy, HHS, or DFS 72‑hour requirement layered on top of the base obligation.
Dim = quiet
No obligation triggered. Confirmed, not assumed — the negative space is part of the record.
Built to hold up
The discipline behind the clock.
The map is only as good as the corpus underneath it. Here's the discipline that keeps it honest.
§ 1
Versioned, never overwritten
A statute amendment creates a new version. The deadline that applied at discovery keeps applying to that incident — recomputation is explicit, and every change is logged.
§ 2
Counsel-validated at release
Every version of the corpus is reviewed before it ships. Nothing reaches your incident that hasn't been checked first.
§ 3
Change-notices, not surprises
When a statute amends, affected tenants hear about it as a dated, cited notice — not a support ticket after the fact.
Built for two desks
One clock, two ways to run it.
White-label
For breach coaches & IR firms
Run every client's notification under your own brand — the map, the clock, and the record, white‑labeled. Your name on the letter; our clock keeping it on time.
Direct
For compliance leads
Build the binder before the bad day, or run it live when it arrives. Either way, it's the same map your counsel signs off on.