Respuesta a incidentes
Información de referencia en inglés sobre detección y comunicación de incidentes.
Documento de referencia en inglés. El cuerpo original se conserva sin modificar sus compromisos. Para aclaraciones sobre su alcance o vigencia, utiliza los contactos indicados en esta página.
Our commitments
If a security or availability incident affects you, we will:
| Action | How |
|---|---|
| Investigate as soon as we detect it or you report it | Reports to [email protected] go straight to the engineering team. |
| Notify affected account owners by email | As soon as we know customer data may be affected, with what we know and what we recommend you do. |
| Notify supervisory authorities | Within the deadlines the GDPR sets for personal data breaches (72 hours from awareness where required). |
| Publish a post-mortem for significant incidents | In the changelog, with timeline, root cause and remediation. |
We do not operate a public status page or offer a contractual SLA at this time. Fluyio is a small team: we would rather commit to what we can deliver than publish response times we cannot guarantee.
Severity ladder
| Level | Definition | Example |
|---|---|---|
| SEV-1 | Confidentiality of customer data confirmed compromised, or platform fully unavailable. | Database exposed externally; total outage. |
| SEV-2 | Suspected confidentiality issue under investigation, or one account unable to operate. | Suspicious cross-account access pattern; a tenant unable to send. |
| SEV-3 | Degradation affecting some users, no data risk. | Slow campaign sends; dashboard errors. |
| SEV-4 | Internal-only issue. | Monitoring noise, near-miss, maintenance overrun. |
SEV-1 and SEV-2 always trigger customer-facing communication. SEV-3 and SEV-4 are handled internally and appear in the changelog when they change behaviour.
Detection
- Application alerts on authentication anomalies, queue failures and quota events.
- Provider signals from Resend (bounces, complaints), Stripe (payment events) and 360dialog (WhatsApp quality).
- Edge protection by Cloudflare (WAF and DDoS mitigation).
- Uptime monitoring of the public health endpoint.
- Customer reports to [email protected].
What you should do
If you suspect your account or an API key is compromised:
Do not wait for us. Take these steps yourself, in order:
- Revoke the affected API key in the dashboard (API keys → Revoke) and create a new one. Revocation is immediate.
- Change your password and enable two-factor authentication if you have not already.
- Email [email protected] with your account name, the key prefix and the timestamps of the suspicious activity.
What we will never do
- Ask you for your password or full API key over email, chat or phone.
- Ask you to disable two-factor authentication "to help debug".
- Push a software update or browser extension during an incident.
Anyone claiming to be Fluyio doing any of the above is not us. Forward the message to [email protected].
Post-incident
After a SEV-1 or SEV-2 is resolved we publish a post-mortem in the changelog covering the timeline, the root cause (technical, not blame), the customer impact, the remediations shipped or planned, and what we would do differently. Account-specific details are redacted.