Incident Response Policy

This policy describes how Aguilar Global LLC (Replyed) responds to a security incident that may affect personal data of merchants or their end customers. It applies to the whole team and all systems.

1. What counts as an incident

• Unauthorised access to customer data or to a store's credentials.
• Loss, alteration or unintended deletion of data.
• Sending a customer's information to the wrong recipient.
• Compromise of an account, an API key or a provider we rely on.
• Severe outage preventing us from meeting data protection obligations.

2. Detection

• Automated error and anomaly alerting.
• Review of the personal data access audit log.
• Bounce, complaint and abuse notifications from email providers.
• External reports: anyone can report a security issue to security@getreplyed.io; we acknowledge within 24 hours.

3. Classification

• Critical: personal data exposed or accessible to third parties. Immediate 24/7 response.
• High: credible risk of exposure or data loss, unconfirmed. Response within 4 hours.
• Medium: security failure with no personal data access. Response within 24 hours.
• Low: weakness found proactively. Scheduled in the normal work cycle.

4. Containment and recovery

1. An incident lead is appointed and a timestamped log is opened.
2. Affected access is cut: keys and tokens revoked, sessions terminated, accounts locked.
3. Email sending for the affected store is paused if there is a leak risk through that channel.
4. Evidence and logs are preserved before any cleanup.
5. Root cause is fixed, data restored from backup if needed, and closure verified.

5. Notification

• Affected merchant: without undue delay and at the latest within 72 hours of becoming aware, by email to the account address. As processor, it is the merchant who notifies their supervisory authority and, where required, their customers.
• Notice content: what happened, when, which data and people are affected, likely consequences, measures already taken and recommendations, plus a direct contact for follow-up.
• Where full information is not yet available, we send an initial notice in time and complete it in phases.
• Shopify: incidents affecting data obtained through their platform are reported within the timeframe their data protection requirements set out.

6. After the incident

Within 14 days of closure we produce a post-incident review with root cause, timeline and corrective actions, and update controls, code and this policy where needed. All incidents are logged even when no notification is required.

7. Contact

Security: security@getreplyed.io · Privacy: privacy@getreplyed.io