Incident Management and Response Policy
The process for reporting, assessing, containing and resolving suspected security incidents.
Reporting and coordination
Suspected unauthorised access, exposed credentials, information disclosure or service abuse should be reported through our contact channel. The report should identify the affected service, when the issue was observed and a safe description of the evidence. Do not send passwords, access tokens or unnecessary personal information. The team handling the report coordinates investigation and follow-up.
Assessment and prioritisation
Assess whether the report represents a security incident, which customers or functions may be affected, whether the issue is ongoing and the potential impact on confidentiality, integrity and availability. Prioritise active compromise, exposed sensitive information and broad service impact. Separate confirmed facts from assumptions throughout the investigation.
Containment and evidence
Where appropriate, contain the incident by limiting affected access, revoking compromised credentials or temporarily restricting affected functions. Preserve relevant evidence while avoiding unnecessary copies of customer information. Record material actions and decisions so that the incident can be understood and reviewed.
Recovery and communication
Address the underlying cause and verify the affected functions before restoring normal operation. Communicate with affected customers when the investigation establishes that notification is appropriate or legally required. Notifications should explain known impact and relevant protective actions without disclosing sensitive investigative information. Any notification obligations must be evaluated against applicable law and contractual commitments.
Post-incident review
Review the cause, impact, response and recovery after a significant incident. Record corrective actions, assign responsibility and verify completion. Update relevant controls and procedures where lessons from the incident indicate a need. This public policy does not promise a fixed response or recovery time.
Security questions and reports
Contact XtraCRM about a suspected security issue or a question about these policies. Include a brief description and the affected service; do not include passwords, access tokens or unnecessary personal information.
Contact XtraCRM →