Last updated October 8, 2026
Overview
SurgeTK maintains a written Incident Response Plan, approved by management. This summary describes how SurgeTK handles security incidents and how it notifies customers.
What we treat as an incident
A security event is an observable occurrence relevant to the confidentiality, integrity, availability, or privacy of SurgeTK data, systems, or networks. A security incident is a security event that results in loss or damage to any of these.
Severity levels and remediation targets
Severity | Definition | Remediation target |
Critical (P0) | Clear evidence of active exploitation by a malicious actor, or a threat of physical harm | 7 days |
High (P1) | Strong likelihood of attack or exploitation, such as a highly exploitable vulnerability or signs of unauthorized access | 14 days |
Medium and Low (P2, P3) | Unconfirmed incidents or unusual behavior that need investigation, with no definitive evidence of significant risk | 90 days |
Senior management is notified immediately of critical incidents.
How we respond
Event reported
Triage and analysis
Investigation
Containment
Recovery and remediation
Hardening and detection improvements
All incidents are documented. Critical incidents receive a documented root cause analysis.
How and when we notify you
Security incidents affecting your personal data. SurgeTK notifies you without undue delay, and no later than 72 hours after SurgeTK becomes aware of a security incident affecting your personal data. The notice describes, as far as known, the nature of the incident, the categories and approximate number of people and records affected, the likely consequences, the measures taken or proposed, and a point of contact. Information not yet available is provided in phases.
Service disruptions. SurgeTK posts updates on its status page at https://status.surgetk.com.
Breach decisions. The CEO and the Security Delegate decide, with legal counsel, whether a breach is reportable. Legal counsel and a company officer approve every external breach notice in writing.
Detection sources
Application error and performance monitoring
Automated dependency scanning and AI-assisted security review of code changes
Continuous monitoring of cloud configuration through SurgeTK's compliance platform
Application and platform logs with a 365-day archive
Customer reports through our support channel
Responsibilities
Role | Responsibility |
Security Delegate | Leads the response, decides follow-up actions, and reports incident details to the CEO |
Incident Response Team | Engineers engaged on the incident until it is formally resolved |
Legal counsel | Determines legal and regulatory exposure and approves external breach notices |
Executive management | Determines with legal counsel whether a breach is reportable; the CEO makes the final decision if there is no consensus |
Plan maintenance
The Incident Response Plan is reviewed at least annually.
Reporting a security concern
Email [email protected] or use the in-app chat. Reports are handled under the severity levels above.