Incident response coordination

Contact paths

The Security Operations Center is staffed continuously. For anything you believe touches the platform rather than only your application, use the P1 path rather than a portal ticket.

• P1, platform integrity. Attestation failure, unexpected measurement change, or suspected platform compromise. Call the SOC line in your onboarding pack.
• P2, platform availability. Host or network unavailability affecting production. Portal ticket marked P2 pages the on-call engineer.
• P3, application scope. An incident confined to your side of the boundary. Tell us if you need log extracts, but you own the response.

The boundary during an incident

We investigate and act on our side of the boundary. That includes the facility, the hardware, the firmware, the hypervisor, and the network up to your segment edge.

We do not access your host operating system or your data. Single tenancy means there is no administrative path for us into a running enclave, which is a security property in normal operation and a limitation during an incident. If the response requires action inside your host, you take it.

We will not ask you for host credentials during an incident, and nobody legitimately representing ServLogi will. Treat any such request as a social engineering attempt and report it to the SOC.

What you receive

• Notification within the timeline in your agreement, for any incident affecting your boundary.
• Platform audit log extracts covering the incident window, on request.
• A written post-incident report for P1 and P2 events, including timeline and remediation.
• Where an incident triggers a regulatory reporting obligation on your side, the factual record you need to meet it. Filing remains yours.