Service Level Agreement
How Platformr detects, evaluates, and resolves security events in the platform, and how we recover the service if a region becomes unavailable.
Disaster recovery
Platformr runs on Amazon Web Services and maintains a standby recovery environment in a separate AWS region. If our primary region becomes unavailable, we fail over to the recovery region within the objectives below.
Recovery region: eu-west-1 (Ireland)
The full Platformr infrastructure is already deployed in eu-west-1 and kept current with production, so there is nothing to build during a recovery.
Data
Production data is copied to the recovery region as needed to bring the environment online and meet the recovery point objective.
Objective and scope
This agreement sets out the responsibilities and expectations for Platformr’s security operations staff in evaluating and mitigating security risks to the Platformr platform. It applies to all security operations staff involved in managing Platformr security events.
Response times by risk level
Every security event is assigned a risk level when it is detected. The risk level sets how quickly we respond, evaluate, and remediate.
| Risk level | Example events | Initial response | Full evaluation | Mitigation or remediation |
|---|---|---|---|---|
| Critical | Compromised access keys, zero-day vulnerabilities | 15 minutes | 1 hour | 4 hours, or as AWS recommends |
| High | IAM privilege escalation risks, major service vulnerabilities | 30 minutes | 2 hours | 8 hours |
| Medium | Deprecated APIs, outdated TLS configurations | 4 hours | 8 hours | 24 hours |
| Low | Informational advisories, minor misconfigurations | 8 hours | 24 hours | 72 hours |
Responsibilities
- Monitoring
- Security operations staff continuously monitor AWS using automated events that drive notifications and documentation.
- Evaluation
- When a risk event is detected, staff evaluate its impact on operations within 30 minutes.
- Mitigation
- Mitigation strategies are put in place within 1 hour of evaluation to minimize potential impact.
- Communication
- Relevant stakeholders are notified of the event and the mitigation steps within 1 hour of detection.
- Documentation
- All actions taken in response to a risk event are recorded within 24 hours.
Performance targets
of risk events evaluated within 30 minutes
of risk events mitigated within 1 hour
of stakeholders informed within 1 hour of detection
Review and reporting
- Weekly review of all risk events and responses.
- Monthly report summarizing risk events, response times, and mitigation effectiveness.
Escalation
If a risk event can’t be mitigated within the specified time, it is escalated immediately to the senior security operations manager.
Amendments
This agreement is reviewed and updated annually, or as needed, to stay aligned with business objectives and AWS updates. By adhering to it, Platformr’s security operations staff ensure timely and effective management of security events, maintaining the platform’s operational integrity and security.