Incident response
SET-SEC-020 · Version 1.0 · 2026-11-09
How SET handles a security or availability incident, and what a customer is told. Compliance matters (suspicious activity, sanctions) follow the Monitoring and reporting standard instead.
1. What counts as an incident
| Severity | Meaning | Examples |
|---|---|---|
| 1 | Customer data or money movement is, or may be, exposed or wrong | Unauthorised access to data; a credential leaked; a payment recorded in the wrong state |
| 2 | A product is unavailable or failing for customers | The API refuses valid requests; webhooks are not delivered; a provider outage |
| 3 | Degraded, with a workaround | A slow chain read; a delayed status update that later corrects itself |
2. How SET detects one
- Automated alerts on stuck payments and on webhook signatures that fail to verify.
- A scheduled re-check, every ten minutes, of deliveries that are still pending.
- Checks run against the deployed service after every release.
- Reports from customers and researchers (Vulnerability disclosure).
3. What SET does
- Contain. Switch off only the affected feature. Each product has its own switch, and switching one off takes effect without a release. Revoke the affected key or access grant.
- Preserve evidence. Records are appended to, never rewritten. Secret values, raw provider payloads and personal data are never copied into tickets, chat or email.
- Rotate. Replace any credential or signing secret that may have been exposed, and confirm that the old one is refused.
- Recover. Roll back to the last verified release, or restore the database to a point in time, in the affected environment only.
- Reconcile. Re-read affected payments from the provider. The ledger is idempotent, so replaying a genuine provider event cannot count a payment twice.
- Review. A written record: what happened, the timeline, the cause, what was changed, and what will stop it happening again.
4. What customers are told
- A confirmed incident affecting a customer's data or money movement: SET notifies that customer's named contact by email without undue delay, with what is known, what SET has done, and what the customer should do. The notice period is the one in the customer's agreement.
- An outage or degradation: shown on the status page check, with direct notice to affected platforms for a severity 1 or 2 incident.
- Afterwards: affected customers receive the written review on request.
SET also meets the notice duties in its provider agreements and in applicable breach-notification law.
5. Contact during an incident
support@simpleeasytransactions.com, subject line Incident. A platform's order form names its escalation contact and hours.