RainbookIncident Response
When something goes wrong with Rainbook or Rainbook Mail Sync, we find it fast, contain it the same day, tell you what happened and fix the cause. This page sets out how, and how quickly you hear from us.
How we find problems
- Alerts on each app's errors, timeouts and failed jobs, which reach our on-call phone around the clock.
- Error reports from the apps, which carry no names, email addresses or record content.
- Your support requests, and the diagnostics an admin chooses to share from Settings › Overview in Rainbook, or from Support on the Rainbook Mail Sync admin page.
- Atlassian's security scanning of Marketplace apps, and Atlassian's own status reports.
- Reports from security researchers at security@rainbook.humanr.ai.
What we do
- Declare. We open an incident with a severity and one incident lead.
- Contain. We can switch off capture, AI, imports or scheduled jobs on their own within minutes, without a new version, while the rest of Rainbook keeps working.
- Fix. We correct the cause and confirm the fix on a test site before it ships.
- Review. Every incident that stopped Rainbook or a core job gets a written review within 5 business days, with what we change because of it.
How quickly you hear from us
| Severity | What it means | First response | Updates |
|---|---|---|---|
| Sev 1 | A security incident, data exposure or loss, or Rainbook unusable for everyone on a site | 2 hours, around the clock | Every 6 hours until resolved |
| Sev 2 | A core job broken with no workaround, such as capture stopped or panels not loading | 8 business hours | Daily |
| Sev 3 | A feature degraded, with a workaround | 1 business day | When it changes |
- Status page: a Sev 1 is posted on our status page within 1 hour of being declared, and a summary of its review afterwards.
- Security incidents: we tell the technical contacts of affected sites by email within 72 hours of confirming an incident that affects their data, with what happened, what data was involved and what we are doing. We report every security incident to Atlassian within 24 hours.
- Personal data: the data processing agreement sets out how we tell you about a personal-data breach.
Business hours and every service level are on our service levels page.
How fast we fix security issues
We fix security vulnerabilities within Atlassian's deadlines for cloud apps: critical within 10 days, high within 4 weeks, medium within 12 weeks and low within 25 weeks.
Practice
We rehearse this process with tabletop exercises, one on data exposure and one on a capture outage, and update it from what we learn.
Report a problem
For a security issue, write to security@rainbook.humanr.ai; our security page explains what to include. For anything else, open a request through support.