Incidents are triaged by impact to confidentiality, integrity, availability, privacy, billing, customer communication, AI execution, and provider integrations.

Response includes detection, containment, investigation, remediation, customer communication where applicable, recovery validation, and post-incident review.

Material incidents should be communicated through status updates or customer notices with affected systems, timeline, mitigation, and next steps.

Activity logs, change history, queue/job records, webhook events, provider error logs, and audit exports support investigation and postmortems.

Postmortems should document root cause, customer impact, corrective actions, owners, due dates, and verification evidence.