Incident Response Policy

Status: Phase 30 G4.T3 deliverable — public-facing incident response discipline statement. Companion docs: docs/trust-center/index.md · docs/compliance/soc-2-tsc-2017-control-mapping.md (CC7.3).

Severity Tiers

| Severity | Definition | Customer notification | |---|---|---| | Sev1 | Customer-facing outage, data exposure, or material data loss | Within 1 hour via status page + email | | Sev2 | Degraded service (slow responses, partial feature unavailability) | Within 4 hours via status page | | Sev3 | Internal-only (build failures, monitoring noise) | n/a |

Detection

Sentry alerting on uncaught exceptions + manually-reported alerts (4-project setup per ADR 0020).
Helicone monitoring on AI cost + latency anomalies (ADR 0022).
Cloudflare anomaly dashboard (rate limit hits, bot traffic).
Status page (Upptime mirror) external probe.

Response

On-call rotation with 15-minute paging SLA.
Sev1 incidents trigger an incident channel (Slack / equivalent) + war-room.
Incident commander assigned within 15 minutes.
Customer notification (Sev1 + Sev2) via status page incident post + email.

Post-Incident

Post-mortem within 5 business days for every Sev1 + Sev2.
Customer-facing summary published to status page incident post.
Internal-facing root-cause analysis in Linear (FER team).
Remediation tracked to closure via Linear manus-review-needed label.

Customer Data Breach

If customer data is exposed, affected customers are notified directly within 72 hours (GDPR breach notification window per ADR 0029).
Regulatory notifications (state AG, HHS for PHI breaches under HIPAA equivalent) per applicable law.
Sub-processor breach notification triggers the same 72-hour customer notification cadence.

Source ADRs

ADR 0009 (webhook delivery semantics) · ADR 0020 (Sentry PII / PHI scrubbing) · ADR 0022 (AI observability schema) · ADR 0029 (GDPR right-to-erasure) · ADR 0039 (public commitments + SLAs).