Data Breach Response Plan

1. Detection

• Automated alerts via Sentry (error spikes, new error types) and UptimeRobot (availability anomalies).
• Manual reports via our security contact — see Security Policy (support@creatorhero.io), acknowledged within 48 hours.
• Structured application and Edge Function logs reviewed for signs of unauthorized access, anomalous queries, or credential misuse.

2. Assessment

Within hours of detection, we assess:

• Scope — which tables, records, and users are affected.
• Data categories — whether the incident involves personal data (names, emails, message content, revenue figures) or only non-personal data.
• Root cause — credential compromise, authorization gap, dependency vulnerability, or a third-party (Stripe, Supabase, Resend, Twilio) incident.
• Severity — classified against our internal incident-response runbook.

3. Containment

• Immediate rotation of any compromised credentials or API keys.
• Disabling the affected function or revoking the affected user/integration session if the vector is isolated.
• Emergency database policy fixes deployed if the root cause is an access-control gap.
• Rollback of the triggering deployment if the vector is a recent release.

4. Notification

If the assessment confirms personal data was accessed, disclosed, or lost without authorization:

• Affected users are notified within 72 hours of discovery, in plain language, describing what happened, what data was involved, and what action to take.
• Supervisory authority — EU data protection authorities are notified within 72 hours if the breach is likely to result in a risk to individuals' rights and freedoms (GDPR Article 33).
• High-risk breaches — individuals are notified directly without undue delay when the breach is likely to result in a high risk to their rights and freedoms (GDPR Article 34).
• Public disclosure — a summary of the incident and remediation is published once containment is confirmed.

5. Post-Mortem

• Root cause, timeline, and remediation are documented internally.
• Regression tests or automated checks are added wherever the root cause is code-detectable.
• This plan and our Security Policy are updated with any resulting process changes.