Security · 02 · Operations
Incident response and containment.
The documented incident response process, the notification commitments, and the containment controls available during an incident.
The plan
The incident response process.
Anyone can raise itone address, always open
Staff, customers, or an outside researcher — one reporting line, no judgment for false alarms. The plan starts at the report, not at certainty.
Severity assessmenta written matrix
Every incident gets a severity level from a written matrix — what's affected, how many, whether data is involved. The level sets the response speed and who is engaged.
One ownernamed, not implied
Every incident has a single named handler from minute one. Evidence is preserved before anything is cleaned up, and a timeline is kept as it happens — not reconstructed after.
Notificationdefined timeframes
Affected customers are notified without undue delay, with facts and next steps — regulators within 72 hours where GDPR applies. The notification templates are prepared in advance.
Post-incident reviewwritten, tracked
Every incident ends with a written review: root cause, what went well, what didn't, and dated action items tracked to completion. The register is append-only.
Testingannual exercise
The plan is exercised annually as a tabletop drill — a realistic scenario, the actual people, the actual steps. The notes and resulting actions are filed as evidence.
Containment
Six containment controls.
Each control exists today, is tested, and every use is logged.
SWITCH 01
Kill a session or user
Any account cut off everywhere in minutes — sessions revoked, tokens dead, access gone.
SWITCH 02
Rotate a secret
Any leaked key or credential replaced immediately, with a runbook so it's routine, not heroics.
SWITCH 03
Isolate a machine
A compromised host cut from the network while evidence stays intact for the investigation.
SWITCH 04
Kill a feature
Any risky feature behind a flag, off in seconds — no deploy, no waiting for a release.
SWITCH 05
Kill the AI
Every AI feature has an off switch that degrades gracefully. The product keeps working; the model stops.
SWITCH 06
Suspend a tenant
A whole account frozen — access, jobs, integrations — reversibly, without touching its data.
Break-glass accesswhen everything is down
Sealed emergency credentials exist for the day normal access fails. Using them trips an alarm, is logged in full, and triggers a review — emergency access that nobody can use quietly.
Monitoringalways on
An append-only audit trail, alerts on the signals that matter, quarterly access reviews, and same-day removal when someone leaves.
Incident response planroles, severity matrix, lifecycle
on requestNotification templatescustomer + regulator, pre-written
on requestKill-switch runbookall six switches + break-glass
on requestLast tabletop exercise notesdated, with completed actions
on requestNext: Compliance and assurance.