Incident Response

Detection and triage

We monitor service health, authentication failures, job errors, rate limits, provider alerts and security reports. Suspected incidents are triaged by impact, affected data, affected customers and legal or contractual notification duties.

Containment and recovery

• Revoke compromised sessions, API keys or SSO configuration.
• Disable affected routes or accounts and block abusive traffic.
• Preserve relevant logs and evidence.
• Rotate secrets and repair the root cause.
• Restore service and verify integrity and access controls.

Notification

If a confirmed incident affects customer personal data, we notify affected customers without undue delay and provide information reasonably needed for their own obligations. We may coordinate with law enforcement or regulators. Notification is not an admission of liability.

Post-incident review

We review the cause, detection, response and preventive actions. Customer-specific reports are available under the applicable agreement. Do not include sensitive data in an initial report.

Report an incident or vulnerability to saar-security@heossi.com.