Incident procedure (security and privacy) for STATIQ

Version 1.0 (draft) · Owner: JIWA HOLDING AS · Incident lead: JIWA HOLDING AS, through its managing director

1. Definitions

A security incident is any confirmed or suspected unauthorized access, alteration, loss or exposure of data, or downtime affecting users. A personal data breach is a security incident involving personal data (GDPR Article 4(12)).

2. Detection and internal notification

Sources: alert thresholds (operations), reports to support@statiqsport.com/privacy@statiqsport.com, supplier notifications (Supabase, Cloudflare, Apple, Stripe). Whoever detects the incident records it in the incident log (date, source, description, affected components) and immediately notifies the incident lead.

3. Triage (within 4 hours)

  1. Classify: severity (critical/high/medium/low), affected data and number of users.
  2. Contain: rotate secrets (wrangler secret put, Supabase), revoke access/links, isolate the component, put the app in read-only mode if necessary.
  3. Preserve evidence: logs (request ID), audit trail (audit_events), timeline.

4. Notification to Datatilsynet and affected people

For personal data breaches posing a risk to individuals: notify the Norwegian Data Protection Authority (Datatilsynet) within 72 hours of becoming aware of the breach (GDPR Article 33). For high risk: notify affected users without undue delay (Article 34) in the app/by email, explaining what happened, the consequences and the measures taken. Document the decision and reasons even when no notification is sent.

5. Recovery

Follow docs/operations/restore-drill.md in the event of data loss. Verify row counts and event md5 before reopening the service.

6. Follow-up (within 10 business days)

Write a blameless report: timeline, root cause, what stopped the incident, what could have detected it earlier, concrete actions with deadlines and owners. Update architecture guards, tests and this document.

7. Contacts

This is an operational or contractual document published for transparency.