At Cust, the security of customer data and the reliability of our service are foundational to our platform. This document outlines our procedures for responding to security incidents and for recovering the service in the event of a major disruption. Our approach is designed to minimize impact, ensure transparent communication, and maintain the trust of our customers.
Our IR procedure governs our response to a confirmed security event (e.g., a data breach, unauthorized access). It is aligned with the NIST Cybersecurity Framework to ensure a structured and effective response.
Incident Commander: Our CTO, Karolis Januskas, serves as the designated Incident Commander and leads the Incident Response Team.
We employ 24/7 automated monitoring of our application and infrastructure, using services including Sentry. These systems are configured to generate real-time alerts upon detection of system errors, anomalous activity, or potential security vulnerabilities. Any alert triggers an immediate analysis by our engineering team to determine the scope and severity of the potential incident.
Upon confirmation of a security incident, our immediate priority is to contain the threat to prevent further impact. This may include isolating affected systems, revoking credentials, or deploying emergency patches. Once contained, our team works to eradicate the root cause of the incident to ensure it cannot reoccur.
Cust is committed to transparent communication. In the event of a security incident impacting customer data, we will notify affected customers via email without undue delay. Our policy is to provide this notification within 24 hours of confirming the incident. The communication will be delivered to your designated security contact and will provide details about the nature of the incident, the potential impact, and our response actions.
After every incident, we conduct a thorough, blameless post-mortem to analyze the root cause, the effectiveness of our response, and opportunities for improvement. The findings are used to implement corrective actions and enhance our security posture.
Our DR procedure governs our ability to maintain service availability and recover from major outages (e.g., infrastructure failure, regional disruption).
We test our disaster recovery plan annually to ensure our procedures, tools, and team are prepared to meet our stated RTO/RPO targets.