Security alerts are logged to the audit trail when suspicious activity is detected and processed.

System health, rate limits, and access patterns are monitored around the clock.

Customers can report suspicious activity through the dashboard or support channels.

Infrastructure and platform monitoring flags anomalies for operator review.

Each alert is classified as low, medium, high, or critical based on data exposure scope.

Operators verify whether the alert is real or a misconfiguration before escalating.

Initial assessment determines which tenants, records, or systems may be affected.

Critical incidents proceed to containment immediately; lower severity is documented and tracked.

Affected sessions are invalidated to stop ongoing unauthorized access.

Suspected compromised credentials are rotated following internal runbook procedures.

Offending IP addresses are blocked at the infrastructure firewall level.

Data is never deleted during an active incident — all forensic evidence is preserved.

Affected customers are notified with: nature of the incident, data categories affected, and measures taken.

Enterprise customers follow contract-defined notification timelines and SLAs.

If personal data is involved, the supervisory authority is notified within 72 hours of awareness.

Every notification is documented in the audit trail with timestamps and recipients.

Operators trace the full scope of access: which tenants, records, and actions were involved.

Platform and infrastructure logs are reviewed for request patterns and offending sources.

The underlying cause is identified — credential leak, code vulnerability, misconfiguration, or insider threat.

All logs and evidence are preserved throughout the investigation; retention purges are paused.

The root cause is patched in code and deployed with verification tests.

All credentials that may have been exposed are rotated as a precaution.

Permissions and access controls are reviewed and tightened if the incident involved privilege escalation.

A full security audit of the codebase is completed before remediation is declared complete.

A full report is prepared for affected customers: timeline, scope, root cause, remediation, and prevention measures.

Regulatory reports are filed if required by GDPR, CCPA, or customer contracts.

The incident response plan is updated based on lessons learned from each incident.

Everything is documented in the audit trail for future reference and compliance evidence.

Repeated API abuse from a single source may indicate brute force or scraping attempts.

Requests that fail same-origin validation are logged and blocked.

Attempts to access data belonging to a different server are detected and denied.

Staff attempting owner-only actions or non-owners modifying billing are flagged.

Requests with malformed or non-existent server IDs may indicate probing.

Any attempt to circumvent billing enforcement is logged and rejected in production.