Incident Response

Last updated: 2026-05-31. Version: 1.0.

This document defines the incident response procedure for security incidents affecting VaultPDF-operated infrastructure (Licensing API, eSign Portal) and provides guidance for customers responding to incidents in their own deployments.

---

Scope

---

Severity Levels

---

Incident Response Process

flowchart TD
    A(["🚨 Incident Detected<br/>(monitoring alert or external report)"])
    --> B["Phase 1 — Detection & Triage<br/>0–2 hours<br/>Acknowledge · assess scope · escalate"]
    B --> SEV{"Severity<br/>Assessment"}

    SEV -->|"Confirmed breach or service unavailable"| P1["P1 — Critical<br/>Acknowledge within 1 hour<br/>Customer notification within 24 hours"]
    SEV -->|"Suspected breach or partial degradation"| P2["P2 — High<br/>Acknowledge within 4 hours<br/>Customer notification within 48 hours"]
    SEV -->|"Advisory / minor or hardening item"| P34["P3/P4 — Medium/Low<br/>Acknowledge within 1 business day"]

    P1 --> C["Phase 2 — Containment<br/>2–8 hours<br/>Revoke keys · rotate secrets<br/>Preserve forensic evidence<br/>Identify scope"]
    P2 --> C

    C --> D["Phase 3 — Customer Notification<br/>GDPR breach: within 72 hours<br/>License key exposure: within 48 hours<br/>Service disruption &gt; 4 hours: within 2 hours<br/>Advisory: within 5 business days"]
    D --> E["Phase 4 — Recovery<br/>Deploy patched services<br/>Rotate all affected secrets<br/>Verify smoke tests pass<br/>Lift rate limits / lockdowns"]
    E --> F["Phase 5 — Post-Incident Review<br/>RCA within 5 business days<br/>Share summary with affected customers<br/>Update controls + GDPR DPA docs<br/>Track improvements in audit backlog"]

    P34 --> F

---

Phase 1 - Detection and Triage (0-2 hours)

1. Alert received via monitoring (Azure Monitor, App Insights anomaly detection) or external report.
2. On-call engineer acknowledges alert in incident tracker.
3. Initial severity assessment: is there evidence of data exfiltration? Is service available?
4. Escalate to Security Lead if P1 or P2.
5. Open incident channel; notify management.

Phase 2 - Containment (2-8 hours)

1. Isolate affected components (revoke keys, rotate secrets, disable endpoints as appropriate).
2. Preserve forensic evidence: export logs, take snapshots before any remediation.
3. Identify scope: which license keys or tenant IDs were exposed?
4. If portal token signing key is suspected compromised: rotate HKDF_ROOT_KEY; all active portal sessions are invalidated.
5. If Licensing API database is suspected compromised: rotate all affected license keys; notify affected customers.

Phase 3 - Customer Notification

Customer notification will include:

• What happened (description of the incident)
• When it happened (timeline with UTC timestamps)
• What data was affected (scope)
• What we have done (containment actions)
• What customers must do (any required customer action)
• How to contact us for further information

Phase 4 - Recovery

1. Deploy patched services to production.
2. Verify all affected keys and secrets have been rotated.
3. Confirm service is operating normally via smoke tests.
4. Lift any rate limits or lockdowns imposed during containment.

Phase 5 - Post-Incident Review

1. Root cause analysis (RCA) completed within 5 business days.
2. RCA summary shared with affected customers on request.
3. Control improvements tracked as audit items; shipped in the next planned release.
4. GDPR DPA documentation updated if required.

---

Reporting a Security Issue

To report a suspected security issue with VaultPDF-operated infrastructure:

• Security incidents - [email protected]
• Enterprise procurement - [email protected]
• DPA and privacy requests - [email protected]

---