Incident Response & Severity Levels

How Qualflare classifies security incidents, our response-time commitments, and how we notify affected customers.

Incident response & severity levels

This page states, in customer-facing terms, how Qualflare classifies a security incident and what response you can expect. It's the operational detail behind the commitments in our DPA and Privacy Policy.

Reporting a security issue

If you believe you've found a vulnerability, email security@qualflare.com. Please don't open a public GitHub issue for a security problem — a public issue is itself a disclosure. See our full vulnerability disclosure policy for what to include in a report.

Severity levels

Every security incident is classified into one of three severities the moment it's identified, and re-classified upward immediately if new evidence changes the picture — we never wait to confirm the worst case before acting on it.

Severity	What it means	Our response
Critical	Your data is exposed, being accessed without authorization, or at risk of being altered or destroyed. Production systems are compromised.	Immediate, all-hands response. Containment comes before root-cause analysis — we stop the exposure first.
High	A credential or encryption key may be compromised, but we have no evidence of actual data access. A known vulnerability is exploitable in production.	Same-day response.
Medium	A vulnerability has been reported but not yet exploited, or we've observed suspicious activity with no confirmed impact.	Response within the week.

A Medium incident is escalated to High the moment we find evidence of exploitation — severity reflects actual risk, not how an incident started.

Notification commitments

If an incident results in a confirmed personal-data breach, we notify affected customers without undue delay and within 72 hours of becoming aware, consistent with GDPR Article 33 — matching the commitment in our DPA. That clock starts when we have enough information to know a notifiable breach occurred, not when an incident is first suspected.

For incidents that don't meet the personal-data-breach bar but still affect service availability or your data specifically, we communicate directly with affected customers as soon as we have something concrete to tell you — we'd rather send an early "we're investigating" than go silent until we have a full picture.

What we don't have yet: a public status page. If you're experiencing what looks like a Qualflare outage, email support@qualflare.com — for now, direct contact is our fastest channel, not a status-page subscription.

Sub-processor incidents

If one of our sub-processors (see the Shared Security Responsibility Model and our DPA's sub-processor list) reports an incident affecting Qualflare data, we treat their notification as the start of our own response, and it flows into the same severity classification and customer-notification commitments above.

Shared Security Responsibility Model — what Qualflare owns vs. what depends on your configuration.
DPA — the contractual breach-notification obligation this page operationalizes.
SECURITY.md — how to report a vulnerability.

Incident Response & Severity Levels