MonkeyMachine — INCIDENT & BREACH NOTICE POLICY

Severity: P1 (confirmed compromise/high risk), P2 (security incident with limited impact), P3 (minor ops).

Channels: email to tenant owner, in‑app banner, status page.

Timeline: initial notice ≤72h from awareness; rolling updates.

Content: description, categories and scope, mitigation taken, actions recommended, contacts (security@, privacy@).

Segmentation: notify only affected customers/regions where feasible.

Responsible disclosure: security.txt; safe harbor; bug bounty — later.