Incident & Breach
Incident Response
We follow a standard incident identification and response process. We post status updates on our status page.
Notification
We will notify customers of any breach without delay. At most within 72 hours.
Incident Response Plan
Our Incident Response Plan provides a structured framework to ensure we detect and react to security incidents swiftly, requiring all personnel to report any suspected event within 24 hours. Once an incident is reported, it is investigated and assigned a severity level within 48 hours, which dictates the priority and timeline for the response. A dedicated team then works to contain, resolve, and recover from the incident, preserving forensic evidence and meticulously documenting all actions taken. Following resolution, we conduct a post-mortem analysis to identify the root cause, and in the event of a data breach involving sensitive information, we are committed to notifying all affected parties and relevant authorities.
Polyaxon follows the incident handling and response process recommended by SANS, which includes identifying, containing, eradicating, recovering from, communicating, and documenting security events. Polyaxon notifies customers of any data breaches as soon as possible via email, followed by multiple periodic updates throughout each day addressing progress and impact. Polyaxon Enterprise plans include a dedicated customer success manager who holds responsibility for customer communication, as well as regular check-ins and escalations.
High Availability
Every part of the Polyaxon service uses properly-provisioned, redundant servers (e.g., multiple load balancers, web servers, replica databases) in the case of failure. As part of regular maintenance, servers are taken out of operation without impacting availability.
Business Continuity
Polyaxon keeps hourly encrypted backups of data in multiple regions on Google Cloud Platform. While never expected, in the case of production data loss (i.e., primary meta-data stores lost), we will restore organizational data from these backups.
Disaster Recovery
In the event of a region-wide outage, Polyaxon will try to bring up a duplicate environment in a different Google Cloud Platform region.
Contingency Planning
The Polyaxon operations team includes service continuity and threat remediation among its top priorities. We keep a contingency plan in case of unforeseen events, including risk management, disaster recovery, and customer communication sub-plans that are tested and updated on an ongoing basis and thoroughly reviewed for gaps and changes at least annually.