What Happens If There Is a Security Incident?
Chatfuel has a formal incident response plan with defined roles, escalation procedures, and communication protocols.
Last updated on
Overview
Chatfuel has a formal incident response plan with defined roles, escalation procedures, and communication protocols. If a security incident occurs, we act quickly to contain it, notify affected parties, and prevent recurrence.
Our Incident Response Process
1. Detection
Our systems run 24/7 monitoring with automated alerts. Security events are detected through:
- Continuous activity monitoring for unusual patterns
- Intrusion detection and prevention systems
- Failed login tracking and anomaly alerts
- Automated vulnerability scanning
2. Containment
Once an incident is confirmed, our security and engineering teams immediately work to contain the threat, isolate affected systems, and prevent further impact.
3. Notification
In the event of a confirmed data breach, affected parties are notified within 24-48 hours in accordance with GDPR and Latin American regulatory requirements.
- Status page updates are published at status.chatfuel.com
- Direct notification to affected clients for security events involving their data
- Regulatory bodies are notified within the legally required timeframe (typically 72 hours)
4. Eradication and Recovery
We eliminate the root cause, restore affected systems, and verify that the threat has been fully resolved.
5. Post-Incident Review
Every incident is followed by a thorough review including:
- Root cause analysis
- Corrective and preventive actions
- Reliability and security improvements
- Documentation for compliance audit trails
Breach Notification by Region
| Region | Notification Requirement |
|---|---|
| EU (GDPR) | Supervisory authority within 72 hours; affected individuals without undue delay |
| Brazil (LGPD) | ANPD and affected individuals within 48 hours |
| Mexico (LFPDPPP) | Affected individuals without undue delay |
| Colombia | SIC and affected individuals per regulatory guidance |
| Chile, Argentina, Peru | Per applicable local data protection law |
What This Means for You
- You will be notified promptly if your data is involved in any security incident
- Incident records and timelines are retained per our Data Retention & Deletion Policy
- Public incident notes never include personal or health data
Contact
If you suspect a security issue or want to report a vulnerability, contact: [email protected]
For general compliance inquiries: [email protected]