Security Incident Response Policy

This policy describes how Metrifact detects, responds to, and recovers from a security incident affecting your data. It's scoped to reflect the actual size and structure of this operation — a small, focused team, not a generic enterprise template.

1. What counts as a security incident

• Unauthorized access to, or disclosure of, personal or connection data
• Compromise of an OAuth token, API key, or the service-role database credential
• A vulnerability that could allow one tenant to access another tenant's data
• Loss of availability caused by a malicious act (as opposed to routine downtime)

2. Detection

Every tool call made through the Service is logged (tool name, user, success/failure, a scrubbed error message) — this activity log is the primary signal for spotting anomalous access. We also monitor for unexpected error patterns and unusual API usage against connected platforms, since a spike often precedes or accompanies a real incident. See our Data Loss Prevention Strategy for how data is minimized in the first place.

3. Immediate response steps

On confirming a suspected incident, in order:

1. Contain — revoke the affected session(s), OAuth token(s), or API key(s) immediately. Session revocation and credential deletion are both already-built, immediately-effective actions in this system, not something that needs to be built during an incident.
2. Rotate — rotate any platform-level secret (OAuth client secret, service-role key) that may itself have been exposed, not just the individual token that was misused.
3. Assess scope — use the activity log to determine which accounts, tools, and time window were affected.
4. Eradicate — fix the underlying vulnerability before restoring any affected access.
5. Recover — restore normal service once the fix is verified.

4. Notification

If an incident affects your personal data, we will notify you without undue delay after confirming it, consistent with the breach-notification commitment in our Data Processing Agreement. Notification will describe what happened, what data was affected, and what we've done about it.

5. Severity

• Critical — confirmed unauthorized access to personal data, or cross-tenant data exposure. Immediate containment, notification target: within 72 hours of confirmation.
• High — a credential compromise with no confirmed data access yet. Immediate containment; notification if access is later confirmed.
• Medium/Low — a vulnerability found and fixed with no evidence of exploitation. Tracked and remediated, no notification required.

6. Post-incident review

After any Critical or High incident, we document the root cause and the fix, and check whether the same class of issue exists anywhere else in the system before considering the incident closed.

7. Reporting an incident to us

If you believe you've found a security issue or suspect your data has been affected, contact security@metrifact.com directly — this is the fastest path to a response.