Incident Response
Carriyo's structured approach to detecting, responding to, and recovering from security incidents.
Last updated October 2026
Severity levels
Security incidents are classified by severity to ensure appropriate response and escalation, as defined in our Incident Management Policy.
Severity
Description
Critical (P1)
Active data breach involving customer PII, complete platform outage, or destructive malware
High (P2)
Partial service degradation affecting multiple customers, unauthorized access to internal systems, or credential compromise
Medium (P3)
Targeted intrusion attempt, vulnerability discovered in production systems, or single-customer service impact
Low (P4)
Routine security alerts, minor policy violations, or informational security events
Response process
Our incident response follows a structured process from detection through post-incident review.
Phase
Description
Detection and reporting
Security events are detected through automated monitoring and alerting, and through employee reports.
Triage and classification
The security team assesses severity, scope and potential impact. An incident commander is assigned for P1 and P2 incidents.
Containment
Immediate actions limit further damage or data loss. Affected systems may be isolated and compromised credentials are revoked.
Eradication and recovery
The root cause is identified and eliminated; affected systems are restored from known-good backups and patched.
Customer notification
Affected customers are notified without undue delay, according to contractual obligations and regulatory requirements.
Post-incident review
A review is conducted within 5 business days of resolution. Root cause, lessons learned and preventive measures are documented and tracked.
Notification process
- Affected customers are notified without undue delay
- For incidents involving personal data, notification is provided without undue delay, consistent with GDPR requirements and contractual obligations
- Notifications include a description of the incident, data affected, actions taken, and recommended customer actions
- A designated incident coordinator serves as the single point of contact
- Regular status updates are provided until the incident is fully resolved
Reporting a security concern
To report a security incident or concern, contact security@carriyo.com. Our security team monitors this inbox and will acknowledge receipt within 4 hours.