Incident ResponsePlan.
How we detect, respond to, and recover from security incidents and service disruptions.
Severity
Severity classification
Data breach, complete service outage, active exploitation
Partial service degradation, security vulnerability discovered
Non-critical service issues, performance degradation
Cosmetic issues, non-urgent improvements
Runbook
Response process
1. Detection & Triage
- • Automated monitoring alerts (health checks every 30s)
- • User reports via support tickets or security@evalguard.ai
- • Sentry error tracking for application crashes
- • Classify severity level (P0-P3)
- • Assign incident commander
2. Containment
- • Isolate affected systems to prevent spread
- • Revoke compromised credentials immediately
- • Enable maintenance mode if needed
- • Preserve evidence and logs for investigation
- • Notify affected customers within 72 hours (GDPR requirement)
3. Investigation
- • Root cause analysis with full audit log review
- • Identify scope of impact (affected users, data, services)
- • Document timeline of events
- • Assess whether data was accessed, modified, or exfiltrated
- • Engage external forensics if needed
4. Recovery
- • Fix passes the full CI verify-gate before deploy (deploy.yml blocks on it)
- • Deploy to production and watch health checks + Sentry for regression
- • Restore from backups if data integrity is compromised
- • Verify all systems are operational
- • Remove any maintenance mode restrictions
5. Post-Incident
- • Publish post-mortem within 5 business days
- • Update status page with incident timeline
- • Implement preventive measures
- • Update runbooks and monitoring based on lessons learned
- • Brief affected customers with final resolution report
Communication
Customer communication
During an incident, we communicate through:
- Status page — Real-time updates at evalguard.ai/status
- Email — Direct notification to affected account owners
- In-app banner — Dashboard notification for active incidents
- Post-mortem — Published within 5 business days of resolution
Posture
Preventive measures
Automated Monitoring
Health checks every 30s, Docker container monitoring every 5 min
Daily Backups
On-box pg_dump at 02:00 UTC, offsite dump at 03:47 UTC, restorability verified daily at 06:00 UTC
Security Scanning
CodeQL, TruffleHog, gitleaks, Trivy + syft/grype SBOM scans in CI and on every deployment
Rate Limiting
Per-route rate limiting with Redis-backed distributed tracking
Audit Logging
Append-only logs for all mutations, chained with per-org SHA-256 so edits are detectable
Encryption
AES-256-GCM at rest, TLS 1.2+ in transit, BYOK support
Report
Report an incident
Security incidents: security@evalguard.ai
Service disruptions: support@evalguard.ai
Status page: evalguard.ai/status
Disclosure policy: evalguard.ai/security/responsible-disclosure