Incident response

Status: DOCUMENT ONLY. This procedure has never been exercised. No drill has been run and no incident has occurred. It is recorded as an unevidenced control (CC7.4) rather than presented as a working one.

What counts

An incident is any of:

• a credential that may have been disclosed — an API key, a signing token, a webhook secret, an OAuth token, the credential key;
• any evidence, however weak, that one customer's data was reachable from another's session;
• an unexpected change to audit_events, signature_events or compliance_evidence, or a broken hash chain;
• a signing link that reached the wrong person;
• unavailability of signing or verification for more than fifteen minutes;
• a subprocessor telling us they had one.

A failing automated compliance check is not automatically an incident, but tenant_isolation, grant_surface, secrets_at_rest and audit_trail_intact failing are: each of those means a control that was holding has stopped.

First hour

1. Write it down. Open a record with the time you were told, who told you, and what they said, before doing anything else. Everything after this is easier to reconstruct if the first line is honest.
2. Contain, in the order that costs least. Revoke the credential (revoke_api_key, oauth_revoke_grant, revoke_operator_token), pause the endpoint, or suspend the tenant. Each of these is a single call and each writes to the trail.
3. Preserve. Do not delete anything and do not "clean up". The append-only tables will refuse anyway; the mutable ones will not.
4. Establish blast radius from the trail, not from memory. audit_events and operator_events say who did what and when, per tenant.

Then

1. Root cause, written as a failing test first. The project's convention: the fix lands with the assertion that would have caught it. Every bug found this session was fixed that way.
2. Notify. Who and by when is a legal question, not an engineering one, and depends on jurisdiction and on what was exposed. This procedure does not set a deadline, because inventing one we have not taken advice on would be worse than saying we have not. What is decided: the customer whose data was involved is told, in plain words, what happened and what we know about what was reached.
3. Record it against the control. app.compliance_attest('soc2','CC7.4', …) with what happened and what changed, so the next auditor sees the procedure operating rather than merely existing.

Roles

OPERATIONAL — not staffed. SignSealer is a small team and there is no on-call rota, no defined incident commander, and no out-of-hours contact. Pretending otherwise in this document would be the exact failure this document set is written to avoid.

What exists: mail.signsealer.com receives, and reports reach a person.

Drills

None performed. A procedure that has never been run is a document. The first drill should be a credential-disclosure walkthrough, because it is the one with the most steps that touch production, and it should be recorded with compliance_attest against CC7.4.