Trust · Incident response
What happens when something goes wrong.
An honest description of our incident process, written so you can put it in your own plan.
Detection
Automated threat detection across infrastructure and application logs, mail-flow anomaly detection per tenant, external monitoring, vulnerability reports through responsible disclosure, and reports from customers (security@ or Console → Support → Incident). On-call engineers respond 24/7.
Severity
| Level | Definition | Response |
|---|---|---|
| SEV-1 | Confirmed or likely unauthorized access to customer data; service-wide outage | 15-minute acknowledgement; incident commander; executive notification; customer updates at least hourly |
| SEV-2 | Single-tenant compromise (e.g., phished customer account), partial outage, vulnerability with likely exploitation | 30-minute acknowledgement; affected customer contacted within 1 hour |
| SEV-3 | Vulnerability without evidence of exploitation; degraded performance | Business-hours response; fix per disclosure timelines |
Process
- Triage and contain: isolate affected components, revoke credentials, pause affected sending, preserve evidence.
- Assess: what data, which customers, which individuals, how; determine whether the event is a Breach of Unsecured PHI (HIPAA four-factor assessment) or a security event under other agreements.
- Notify customers: within 72 hours of determination for any incident involving unauthorized access to customer data, with what we know, what we are doing, and what you may need to do; sooner where we can. Notice goes to the account owner and Security Officer by email and console banner.
- Support your obligations: we provide lists of affected individuals and messages from the audit trail, draft facts for your HHS/FTC/state notifications, and answer regulator questions through you. We do not notify your patients or clients directly unless required by law or you ask us to.
- Remediate and review: root cause, corrective actions, and a written post-incident review shared with affected customers within 10 business days; public summary on the status page for outages over 30 minutes.
Testing
Tabletop exercises at least twice a year, including a simulated SEV-1 with customer notification drafting; a phishing drill for our own staff quarterly. Results feed the risk register.
What we ask of you
- Keep your Security Officer contact current under Organization.
- Subscribe to the status page.
- Report suspected account compromise immediately; use the first-hour guide.
- Include PXCMail in your own incident response plan with the contact [email protected].