Incident response

Events from the audit log, application error stream and vendor security notifications are reviewed on the on-call rotation and during business hours by the security team. Anomalous rate-limit denials, validation failures and authentication errors are triaged as early-warning signals.

Suspected incidents are classified against a four-level severity scale (SEV-1 critical → SEV-4 informational). SEV-1 and SEV-2 incidents trigger the incident commander rotation within fifteen (15) minutes.

The incident commander coordinates scoping and containment: revoking credentials, isolating affected components, blocking malicious traffic, rotating secrets and disabling compromised integrations as required.

The root cause is identified, the vulnerability removed, affected systems restored from a known-good state, and elevated monitoring kept in place for a minimum of seventy-two (72) hours after recovery.

Customers whose data is confirmed affected are notified without undue delay and within seventy-two (72) hours of confirmation, via their designated contact. Regulatory notification (e.g. GDPR Art.33) is handled by the Privacy Officer.

A blameless post-mortem is produced within ten (10) business days. Findings, remediation tasks and owners are recorded in the SecurityIncident register and tracked to closure.