# Entea incident-response policy

Last updated: 18 September 2026  
Status: Interim operating policy; contractual notification terms pending

## Purpose

This policy covers suspected or confirmed events affecting the confidentiality, integrity, or availability of Entea systems or customer data.

## Severity

- **Severity 1 — Critical:** confirmed unauthorized access to customer data, active compromise, destructive cross-tenant impact, or a broad production outage with no workaround.
- **Severity 2 — High:** material security degradation, limited unauthorized access, or major workflow outage with restricted impact or a workaround.
- **Severity 3 — Moderate:** contained control failure, non-sensitive exposure, or service degradation without material data impact.
- **Severity 4 — Low:** suspected weakness, policy deviation, or informational event requiring investigation.

## Response sequence

1. **Receive and preserve.** Record the report, time, reporter, affected service, observable evidence, and initial scope. Do not copy live secrets into tickets or chat.
2. **Triage.** Assign severity, an incident owner, and immediate containment tasks.
3. **Contain.** Revoke exposed credentials, isolate affected workloads, pause risky automation, or restore a known-good release as appropriate.
4. **Investigate.** Preserve logs and artifacts, determine entry point and affected organizations, and maintain a decision timeline.
5. **Eradicate and recover.** Remove the cause, rotate affected secrets, restore verified data or releases, and validate service health.
6. **Communicate.** Notify affected customers without undue delay after confirming a material incident. Contractual and legal notification deadlines take precedence.
7. **Review.** Document root cause, impact, corrective actions, owners, and due dates. Track actions to closure.

## Customer communication

Initial communications should state what is known, what is unknown, customer actions, and the next update time. Entea will not claim an incident is resolved until containment and recovery have been verified.

No fixed breach-notification hour commitment is currently offered publicly. A customer-specific window must be established in the signed agreement and DPA.

## Reporting

Report a suspected security incident through https://entea.in/support or email connect@entea.in with the subject “Security report.” Do not include credentials, tokens, private keys, or unnecessary personal data in the first report.