Incident Response

Date: 2026-05-14 Status: Drafted. Not yet exercised against a paying-customer incident.

1. Detection

Sev level assigned at first triage. Sev matrix in RUNBOOK.md.

2. Triage

Founder rotation

1. Giles-Evan Mboumi (Founder, CEO), primary on-call, customer comms lead
2. Christian Montgomery (Co-Founder, COO), backup, security/infra and delivery lead
3. Abhishek Jha (CTO), technical/architecture escalation
4. engineering on-call, extended-hours tertiary for production fires

Rotation cadence: weekly during pilot phase; formal PagerDuty rotation post-Series A.

engineering on-call

Platform engineering partner under NDA provides extended-hours on-call for production fires. Operational SLA per partnership terms (per partnership terms , available on request through diligence room access).

First-response checklist

1. Confirm severity (Sev 1-4)
2. Open incident channel (founder + engineering on-call)
3. Capture initial state: timestamp, affected surface, scope of impact
4. Pull CloudWatch + Sentry context
5. If Sev 1: notify customer per BAA terms before remediation if customer-impacting
6. Begin remediation

3. Communication

Customer notification

Internal notification

• Sev 1: immediate founder channel
• Sev 2: within 2 hours founder channel
• Sev 3: next business day digest
• Sev 4: weekly review

Investor notification

• Sev 1 events that materially affect commercial trajectory: included in next monthly investor update with summary + remediation
• Sev 2 events: aggregated in monthly update if multiple
• Routine Sev 3 / Sev 4: not surfaced

4. Post-mortem cadence

• 24 hours after resolution: initial post-mortem (blameless format)
• Template fields: incident date, impact, root cause, detection, response, resolution, lessons, action items
• Action items tracked in engineering backlog with owner + due date
• Customer-facing post-mortem provided per BAA terms

5. PHI breach-specific protocol

If PHI exposure is suspected (not yet confirmed): 1. Immediately preserve forensic evidence (CloudTrail, S3 access logs, application logs) 2. Begin internal investigation within 1 hour 3. Engage outside counsel (retainer on file , counsel name available on request through diligence room access) 4. Do NOT publicly disclose pre-investigation 5. Customer notification triggered on confirmation (60-day window from confirmation, not from suspicion)

If PHI exposure is confirmed: 1. Customer notification per BAA terms (60-day window) 2. OCR (Office for Civil Rights) notification if > 500 individuals affected (per HIPAA Breach Notification Rule) 3. Affected-individual notification within 60 days of discovery 4. Public-facing summary if > 500 individuals affected (HHS portal) 5. Substitute notification (media) if > 500 in same jurisdiction and contact info unavailable

Outside counsel + breach coach engagement is mandatory for any confirmed PHI breach.

6. Sub-processor incident protocol

If a sub-processor (AWS, Anthropic, Persona, Checkr, WorkOS, Drata, Sentry) reports an incident that affects Rōvn:

1. Confirm scope with vendor
2. Identify affected Rōvn customers
3. Pull internal evidence on Rōvn-side data flow during incident window
4. Notify affected customers per BAA terms (typically within 24-72 hours of vendor confirmation)
5. Forward vendor remediation + Rōvn-specific remediation
6. Track for cumulative review at quarterly compliance check-in

7. Specific playbooks

7.1: PHI exposure via Sentry scrub failure

1. Disable Sentry sender for affected surface
2. Review last 24 hours of Sentry events for PHI scrub failure
3. Engage Sentry support to delete affected event data
4. Trigger confirmed breach protocol if PHI was sent to Sentry

7.2: Database PHI exfiltration suspected

1. Lock down database access (revoke ECS task role temporarily; failover to read-only)
2. Pull RDS audit log + CloudTrail
3. Identify exfil vector
4. Customer notification if PHI > 0 records exposed
5. Forensic snapshot of database state

7.3: Anthropic API incident

1. Confirm vendor status
2. Failover to Bedrock path (target capability)
3. Queue inflight executor calls
4. Customer notification only if pilot customer SLAs impacted

7.4: Source authority API integrity (e.g., wrong data returned)

1. Pause affected adapter
2. Source-receipt review for affected verifications
3. Vendor escalation
4. Re-verify affected workers via alternate source

7.5: Audit log integrity failure

1. Sev 1 escalation immediately
2. S3 Object Lock should make this impossible; if alarm fires, treat as compromise
3. CloudTrail review of all account activity
4. Engage outside counsel + AWS support

8. Tooling status

End of incident response.