Incident Response and Business Continuity Policy
linkhaus, LLC · Effective November 4, 2026 · Owner: Company owner · Review: At least annually
This policy establishes operating requirements. Implementation evidence, configuration records, and completed reviews are maintained separately; publication alone is not proof that every control has been implemented or audited.
Responsibility and reporting
The company owner is the incident lead and coordinates assessment, containment, recovery, and communications. Personnel and providers must report suspected compromise, exposed credentials, data loss, or significant disruption promptly to shie@linkhaus.ai. Reports should include timing, affected services, and observed behavior without sending passwords or tokens. If email is compromised, use the affected provider's authenticated support channel and a verified alternative contact method.
Response procedure
Record the report and assess severity, affected users, data, and services. Contain the incident by restricting access, isolating affected workloads, or revoking exposed credentials as appropriate. Preserve relevant logs and evidence with restricted access. Investigate and remediate the cause, restore from a verified source, and validate integrity and access controls before normal operation resumes. Record decisions, timestamps, actions, and unresolved risks.
Communications
The incident lead must coordinate timely updates to affected users and providers and determine notification obligations under applicable agreements, platform rules, and law. Notifications must describe verified facts, impact, actions taken, and practical next steps. Required notifications must meet the applicable deadlines; uncertainty must not be presented as confirmed fact.
Business continuity
The owner must maintain a business impact assessment covering identity and authorization, the database, media storage, public guides, and publishing workers. It must identify dependencies, recovery priorities, and approved recovery time objectives (RTOs) and recovery point objectives (RPOs). Backup availability and restoration procedures must be verified against those objectives. Recovery targets are internal planning requirements, not a public uptime or recovery guarantee.
Exercises and review
At least annually, conduct an incident-response exercise and a recovery review, retaining the scenario, participants, results, and corrective actions. After a material incident, document lessons learned and update procedures. This policy requires those activities; it does not claim an exercise or restoration test has already been completed.
Exceptions require owner approval, documented safeguards, and a review date. Contact: shie@linkhaus.ai.