---
title: Incident response
category: security
order: 4
lastUpdated: 2026-06-08
featureAvailability: GA
roles: [admin, district-admin]
relatedArticles: [security/vulnerability-reporting, procurement/security-overview, procurement/audit-logging]
---

## At a glance

- **Purpose:** Describe how AmplifyED detects, escalates, and communicates about security incidents.

## What counts as an incident

A security incident is any confirmed or suspected event that affects:

- The confidentiality of customer data (unauthorized access, disclosure).
- The integrity of customer data (unauthorized modification).
- The availability of the service (significant outage).

Operational degradations (slow queries, flaky integrations) are tracked as service incidents, not security incidents.

## Detection

- Continuous logging of authentication events, privileged actions, and infrastructure alerts.
- Anomaly detection on sign-in patterns (geo, velocity, repeated failures).
- Dependency vulnerability scanning on every build.
- Customer reports via security@amplifyed.app.

## Response phases

1. **Triage** — within 1 hour of detection or report, classify severity and assign an incident lead.
2. **Contain** — revoke compromised credentials, disable affected integrations, snapshot affected data.
3. **Investigate** — preserve audit log, reconstruct timeline, identify scope.
4. **Notify** — see notification commitments below.
5. **Remediate** — patch root cause, deploy fix, verify.
6. **Post-incident review** — written summary within 14 days for any incident affecting customer data.

## Notification commitments

- **Customer notification:** within **24 hours** of confirming that a security incident affected customer data, the billing contact and any designated security contact on file are notified by email.
- **Regulatory notification timing** is set by your district's policy and applicable law; AmplifyED supplies the technical timeline and scope evidence you need to meet that timing.

## What we provide for your investigation

- Filtered audit log export covering the incident window.
- Timeline of platform-side actions and remediation.
- Root-cause analysis (high-level by default; deeper detail under NDA).
- Affected-record list if data confidentiality was impacted.

## Customer responsibilities

- Maintain an up-to-date **security contact** for incident notifications (Administration → Organization → Notifications).
- Rotate any credentials your district issued (LMS developer keys, SCIM tokens) if compromise is suspected.
- Engage your district's incident response plan in parallel.

## Related articles

- [Vulnerability reporting](/help/security/vulnerability-reporting)
- [Security overview](/help/procurement/security-overview)
- [Audit logging](/help/procurement/audit-logging)

## FAQ

**Do you have a status page?**
Yes — status.amplifyed.app (subscribe to email or RSS for proactive updates).

**Will you tell affected parents directly?**
No. AmplifyED notifies the district; the district notifies parents per its FERPA and state-law obligations.