Incident Response
faktoora operates a structured incident management process aligned with the requirements of DORA (Digital Operational Resilience Act). This page describes how we detect, classify, respond to and communicate security incidents.
Detection
We use several layers of monitoring and automated alerting to detect incidents early in our application, infrastructure and supply chain.
Classification
Assessment begins within 30 minutes of becoming aware of an incident; it is classified according to the following criteria:
| Factor | Assessment |
|---|---|
| Number of customers affected | Single customer, a subset or all customers |
| Duration of the impact | Temporary, sustained or ongoing |
| Data sensitivity | Public, internal, confidential or restricted |
| Service criticality | Core platform, supporting service or non-critical |
| Economic impact | Revenue, contractual or regulatory implications |
Severity Levels
Business hours are Monday to Friday, 09:00–17:00 (CET/CEST), excluding public holidays in Bavaria. For customers on the Custom ("Individuell", Enterprise) plan, the deadlines in section 10 of the Service Level Agreement apply.
| Severity | Definition | Response time |
|---|---|---|
| Critical | Core service unavailable or confirmed data breach | Automatic detection around the clock; assessment begins within 30 minutes of becoming aware |
| High | Significant user-facing impact or potential data exposure | Without undue delay during business hours |
| Medium | Limited impact, no data at risk | Within 1 business day |
| Low | Minor issue, no user impact | Within 5 business days |
Customer Communication
| Severity | Notification period | Channel |
|---|---|---|
| Critical | Within 1 hour of classification, updates every 2 hours | Email to affected customers |
| High | Within 4 hours where users are affected | Email to affected customers |
| Medium | Available on request | Via support channels |
| Low | Available on request | Via support channels |
Supporting Your Regulatory Reporting
Many of our customers have their own reporting obligations – for example financial entities under DORA or controllers under the GDPR. Our incident process is designed to provide you promptly with the information for your own notifications:
| Information | Timing | Content |
|---|---|---|
| Initial notification | Within 4 hours of classification as a major incident (no later than 24 hours after detection) | Incident type, affected services, time of detection, preliminary impact assessment |
| Intermediate update | Within 72 hours of the initial notification | Updated impact assessment, cause (if known), containment measures, affected data |
| Final report | Within 1 month of the intermediate update | Root cause analysis, overall impact, remedial measures, lessons learned |
We notify our customers of personal data breaches without undue delay, as set out in our Data Processing Agreement. Where faktoora itself is the controller, we notify the competent supervisory authority in accordance with Art. 33 GDPR.
Containment and Recovery
Our incident response process follows these phases:
- Containment - Isolate affected systems to prevent further impact
- Evidence preservation - Secure audit logs, application logs and access logs
- Root cause analysis - Identify the underlying cause
- Remediation - Implement fixes and verify the remediation
- Recovery - Restore normal operations and confirm stability
Post-Incident Review
Every incident of severity High or Critical is reviewed within 5 business days:
- Complete timeline of detection, response and recovery
- Root cause analysis
- Impact assessment (customers, data, services)
- Evaluation of the effectiveness of the response
- Preventive measures to avoid recurrence
Lessons learned are documented and integrated into our security controls and procedures.
Retention of Incident Records
All incident records are retained for at least 5 years, based on DORA.
Reporting an Incident
If you suspect a security incident affecting faktoora or your data:
- Security incidents: security@faktoora.com
- Data protection incidents: privacy@faktoora.com
To report a vulnerability, please visit our Vulnerability Disclosure page.