Lifecycle
- Detect: monitoring, scanning, and reports from staff, customers, and researchers
- Triage: severity classification and assignment of an incident owner
- Contain: isolate affected systems, rotate credentials, block the vector
- Eradicate and recover: remove the cause, restore service, verify integrity
- Review: written post-incident review with corrective actions and owners
Notification
Where an incident affects personal data, we notify affected customers and, where required, regulators without undue delay and within applicable statutory timeframes.
Evidence and records
Timelines, decisions, and communications are documented and retained for the period required by law and contract.
Continuous monitoring
Automated security scanning runs on a schedule and after deployments, and findings are tracked to closure with remediation status.
Changes to this document
We may update this document as our services, technology, and legal obligations evolve. Material changes are published with a new version number, an updated effective date, and a summary of changes in the version history below.
Continued use of our websites, products, services, experiences, or communities after an update takes effect constitutes acceptance of the current version.
Contact
Questions about this Incident Response Summary may be sent to our legal and compliance contact through the contact form on this site. Please reference the document title and version number.
- Legal & compliance requests: use the Contact Legal link on this page
- Privacy and data rights requests: see the Consumer Privacy Rights policy
- Accessibility accommodations: see the Accessibility Statement
Review notice
This document is a high-quality draft template prepared for review. It is not legal advice and no guarantee of compliance is made or implied. Final responsibility for legal sufficiency rests with the organization's licensed legal counsel.
Need to report an incident?
Suspected incidents are triaged the same business day.