Published: November 13, 2026
Cotton Branch Refuge Project protects information about donors, employees, volunteers, applicants, visitors, partners, and the people involved in its programs. This policy sets responsibilities for anyone using organizational systems or handling information on our behalf. Our Website Privacy Policy explains public-facing collection and choices; this policy explains how we manage access and respond to incidents.
Collect less and restrict access
Collect information needed for a defined organizational purpose and use it for that purpose. Avoid gathering sensitive information merely because a form or tool makes it possible. Classify confidential material, limit access to people who need it, and use an approved secure exchange for sensitive records. Do not request payment credentials, identity documents, or detailed medical information through ordinary email or a public inquiry.
Use individual accounts and role-based permissions wherever available. Shared access must be justified, limited, and managed securely. The responsible leader reviews access periodically and when someone's role changes, and promptly removes access when a relationship ends.
Accounts, devices, and providers
- Use strong, unique passwords and an approved password manager. Enable multifactor authentication for organizational accounts that support it, especially email, finance, storage, and administrative access.
- Keep devices and software updated, use screen locks and appropriate encryption, and protect backups and recovery information.
- Verify unusual requests, credential prompts, payment changes, and links through a trusted separate channel. Do not share passwords or security codes by email or chat.
- Assess a provider's purpose, access, safeguards, and applicable terms before sharing organizational information. Limit access to the work being performed and review it when a service changes or ends.
- Do not upload confidential, personal, donor, personnel, or animal-care records into AI or other outside tools without appropriate authorization and safeguards. Follow our AI Policy.
Retention, recovery, and continuity
Keep important organizational records in approved locations with backups appropriate to the risk. Periodically check that essential information can be recovered. Protect recovery codes, administrator access, and service ownership so one unavailable person does not make critical systems inaccessible.
Follow the Records Retention & Destruction Policy, including legal holds. Security inventories, credentials, recovery instructions, and detailed response playbooks are restricted internal records; they are not published on this website.
Report a suspected incident promptly
A lost device, exposed link, misdirected message, compromised account, suspicious payment instruction, malware, or unintended disclosure may be a security incident. Report it promptly to Evan Costner at evan@cottonbranch.org, using a separate trusted channel if that account may be compromised. The Board reporting route is available if management is implicated or an ordinary channel is unsafe.
Share the affected service, approximate time, what happened, and a safe contact method. Do not send passwords, recovery codes, payment credentials, or a complete exposed dataset as proof. Do not investigate beyond your authority or destroy evidence while trying to fix a problem.
A coordinated response
The responsible leader coordinates containment, preservation of relevant evidence, access restriction, credential changes, provider assistance, and restoration of safe operations. Assess what information and people may be affected, document the facts and decisions, and seek appropriate technical, insurance, and legal assistance.
Provide notices to affected people, regulators, partners, or others when required by applicable law or agreements and within the relevant deadlines. A determination must be based on the actual incident; we do not promise that every security event is legally a reportable breach. After containment, review the cause and improve safeguards and training. Honest reporting is protected from retaliation.