Incident Response and Breach Notification

Detection

The platform emits security-relevant events from every service into a tamper-evident audit chain, with runtime anomaly detection and alerting in the security-monitoring service. Containment actions (blocking a source, quarantining a workload, disabling a credential, forcing a key rotation) are wired to real controls, not to a dashboard that only reports.

Response stages

• Triage — confirm, classify severity, and assign an incident lead.
• Contain — stop the bleeding, preserve evidence, protect key material first.
• Eradicate and recover — remove the cause, restore service, verify integrity of the audit chain.
• Notify — see the timelines below.
• Post-incident — root-cause analysis and a committed regression guard so the same failure cannot recur silently.

Notification commitments

Where QNSI, acting as processor, becomes aware of a personal-data breach affecting your data, we will notify you without undue delay so that you can assess and meet your own GDPR Article 33, PDPA, or other notification duties.

Notification will include, as far as it is known at the time: what happened, which data categories and roughly how many records are affected, the likely consequences, and the measures we have taken or propose. If we do not yet know something, we will say that rather than guess — and we will follow up.

Key-compromise

A suspected compromise of key material is treated as the highest severity. The response is: revoke, rotate, re-wrap, and re-attest — in that order — with every step written to the audit chain so that you can independently verify what was done.

Contact

Security incidents: qnsi-security@heossi.com (see also the Vulnerability Disclosure Policy).