Security Incident Response Policy
01Purpose
This policy establishes procedures for identifying, responding to, and recovering from security incidents that affect the Synthesis platform, its users, or their data. The goal is to minimize damage, reduce recovery time, and protect merchant and customer data.
02Scope
This policy applies to all systems, data, and services operated by Synthesis Intelligence, Inc., including:
- The Synthesis platform and API (hosted on Google Cloud Run)
- Data stores (Google BigQuery, Google Firestore)
- Third-party integrations (Amazon, Shopify, Meta)
- Internal tools, credentials, and infrastructure
03Incident Classification
| Severity | Description | Response Time |
|---|---|---|
| Critical | Confirmed data breach, unauthorized access to merchant or customer data, compromised credentials | Immediate (within 1 hour) |
| High | Suspected breach, unauthorized access attempts, service compromise, malware detection | Within 4 hours |
| Medium | Unusual access patterns, failed authentication spikes, configuration errors exposing data | Within 24 hours |
| Low | Minor policy violations, non-sensitive system anomalies, phishing attempts (blocked) | Within 72 hours |
04Incident Response Phases
Phase 1 — Detection & Identification
- Monitor Google Cloud audit logs, Cloud Run logs, and BigQuery access logs for anomalies
- Review alerts from Google Cloud Security Command Center
- Investigate reports from users, merchants, or platform partners (Amazon, Shopify, Meta)
- Classify the incident severity using the table above
Phase 2 — Containment
- Isolate affected systems (revoke compromised credentials, disable affected endpoints)
- Rotate API keys and access tokens for any compromised integrations
- Preserve evidence (logs, snapshots) before making changes
- Activate short-term containment to stop immediate damage
Phase 3 — Eradication
- Identify the root cause of the incident
- Remove malicious artifacts, unauthorized access, or compromised components
- Patch vulnerabilities that were exploited
- Verify that all entry points used by the attacker are closed
Phase 4 — Recovery
- Restore affected systems from verified clean backups if needed
- Re-deploy services with patched configurations
- Monitor systems closely for signs of recurring compromise
- Gradually restore normal operations
Phase 5 — Post-Incident Review
- Conduct a post-mortem within 5 business days of resolution
- Document the timeline, root cause, impact, and actions taken
- Identify process improvements and update this policy as needed
- Implement preventive measures to avoid recurrence
05Notification Requirements
Affected Merchants
If merchant or customer data is confirmed to have been compromised, we will notify affected merchants within 72 hours of confirmation, including:
- Nature and scope of the breach
- Types of data affected
- Steps taken to contain and remediate
- Recommended actions for the merchant
Platform Partners
We will notify Amazon (within 24 hours per SP-API requirements), Shopify, Meta, and other platform partners as required by their partner agreements and data protection requirements. Amazon security incidents are reported to security@amazon.com.
Regulatory Authorities
We will notify relevant regulatory authorities as required by applicable law (e.g., GDPR, CCPA) within mandated timeframes.
06Data Breach Procedures
In the event of a confirmed data breach involving merchant or customer personal data:
- Immediately revoke all potentially compromised access tokens (Amazon, Shopify, Meta)
- Audit BigQuery access logs to determine the scope of data accessed
- Determine which merchants and customers are affected
- Prepare breach notification communications
- Offer affected merchants assistance in notifying their customers if required
07Roles & Responsibilities
| Role | Responsibility | |
|---|---|---|
| Incident Lead | Coordinates response, makes containment decisions, communicates status | |
| Engineering | Investigates technical root cause, implements containment and fixes | |
| Communications | Drafts and sends notifications to merchants, partners, and authorities | |
08Preventive Measures
- All secrets and credentials stored in Google Cloud Secret Manager
- Tenant-isolated data architecture (separate BigQuery datasets per organization)
- HMAC verification on all webhook endpoints
- JWT authentication on all API endpoints
- Regular review of access logs and permissions
- Principle of least privilege for all service accounts
09Policy Review
This policy is reviewed and updated at least every 6 months, or immediately following a security incident that reveals gaps in the response process.
10Contact
To report a security incident or vulnerability: