Security Incident Response Plan

This plan defines roles and procedures for responding to suspected or confirmed security incidents involving Servstead systems or data, including financial data received through Plaid.

Employees, contractors, and customers report suspected incidents to servstead@gmail.com immediately.

Reports should include: date/time observed, systems affected, data types potentially involved, and steps already taken.

Low: failed login attempts, spam, non-exploitable bugs without data exposure.

Medium: vulnerability with limited exposure potential, unauthorized access attempt blocked by controls.

High: confirmed unauthorized access, data exfiltration, compromise of production credentials, or exposure of financial integration tokens.

(1) Triage — Information Security Lead confirms the incident and assigns severity within four (4) business hours of report.

(2) Containment — revoke compromised credentials, disable affected integrations, block malicious IPs, or take affected components offline as needed.

(3) Eradication — remove unauthorized access, patch vulnerabilities, rotate secrets.

(4) Recovery — restore services from known-good state; verify integrity before re-enabling integrations.

(5) Post-incident review — document root cause, timeline, and preventive actions within fourteen (14) days.

Affected customers are notified without undue delay when a confirmed incident impacts their personal information or financial data, consistent with applicable law.

Notifications include a description of the incident, data types affected, and remediation steps.

When incidents involve subprocessors (Supabase, Stripe, Plaid, etc.), we coordinate with the vendor's security team and follow their guidance.

Incident summaries, timelines, and remediation actions are retained for at least three (3) years.

Information Security Policy: https://servstead.com/policies/security

Privacy Policy: https://servstead.com/policies/privacy

Report incidents: servstead@gmail.com. Legal/privacy: servstead@gmail.com.