Incident response

At a glance

• Purpose: Describe how AmplifyED detects, escalates, and communicates about security incidents.

What counts as an incident

A security incident is any confirmed or suspected event that affects:

• The confidentiality of customer data (unauthorized access, disclosure).
• The integrity of customer data (unauthorized modification).
• The availability of the service (significant outage).

Operational degradations (slow queries, flaky integrations) are tracked as service incidents, not security incidents.

Detection

• Continuous logging of authentication events, privileged actions, and infrastructure alerts.
• Anomaly detection on sign-in patterns (geo, velocity, repeated failures).
• Dependency vulnerability scanning on every build.
• Customer reports via security@amplifyed.app.

Response phases

1. Triage — within 1 hour of detection or report, classify severity and assign an incident lead.
2. Contain — revoke compromised credentials, disable affected integrations, snapshot affected data.
3. Investigate — preserve audit log, reconstruct timeline, identify scope.
4. Notify — see notification commitments below.
5. Remediate — patch root cause, deploy fix, verify.
6. Post-incident review — written summary within 14 days for any incident affecting customer data.

Notification commitments

• Customer notification: within 24 hours of confirming that a security incident affected customer data, the billing contact and any designated security contact on file are notified by email.
• Regulatory notification timing is set by your district's policy and applicable law; AmplifyED supplies the technical timeline and scope evidence you need to meet that timing.

What we provide for your investigation

• Filtered audit log export covering the incident window.
• Timeline of platform-side actions and remediation.
• Root-cause analysis (high-level by default; deeper detail under NDA).
• Affected-record list if data confidentiality was impacted.

Customer responsibilities

• Maintain an up-to-date security contact for incident notifications (Administration → Organization → Notifications).
• Rotate any credentials your district issued (LMS developer keys, SCIM tokens) if compromise is suspected.
• Engage your district's incident response plan in parallel.

Related articles

• Vulnerability reporting
• Security overview
• Audit logging

FAQ

Do you have a status page? Yes — status.amplifyed.app (subscribe to email or RSS for proactive updates).

Will you tell affected parents directly? No. AmplifyED notifies the district; the district notifies parents per its FERPA and state-law obligations.