Incident response

Detection

Application and platform telemetry is centralised, with alerting on error rates, authentication failures, authorisation denials and availability. Alerts fire on state change rather than on every cycle, so a live incident is distinguishable from a latched one — a monitor that reports continuously is a monitor nobody reads.

Containment and investigation

The immediate objective is to stop the exposure, not to explain it: revoke the credential, disable the path, roll the revision. Investigation follows from the audit trail, which is hash-chained and therefore usable as evidence rather than merely as a log.

Notification

Affected customers are notified on the timeline their agreement and applicable law require. A notification will say what happened, what data was involved, what we have done, and what remains open. We would rather send an incomplete notice on time than a complete one late.

To report something you believe is an incident: sales@mindhyve.ai, with "security" in the subject.