What is ConsentX's data breach incident response process?

ConsentX follows a five-stage incident response process: detect and triage, contain, notify, eradicate and recover, and post-incident review. Every incident is assigned an owner, and significant incidents undergo a written root-cause review that feeds back into our security controls.

How quickly does ConsentX notify customers after a data breach?

ConsentX notifies affected customers without undue delay and within 48 hours of becoming aware of a personal data breach, as committed in our Data Processing Agreement (DPA). This timeline applies to breach notifications under both GDPR and DPDPA.

Does ConsentX support DPDPA breach notification requirements in India?

Yes. Alongside customer notification, ConsentX supports notification to India's Data Protection Board and affected data principals as required under the Digital Personal Data Protection Act (DPDPA), in addition to standard GDPR breach notification obligations.

What uptime SLA does ConsentX offer?

ConsentX operates to a 99.9% uptime target, with a contractual uptime SLA available on the Enterprise plan. The consent widget is also designed to fail open, so a ConsentX outage does not block your website's checkout or page rendering.

Is ConsentX SOC 2 or ISO 27001 certified?

Not yet. ConsentX does not claim SOC 2 or ISO 27001 certification until independently verified - both are on the product roadmap. Current security controls include TLS encryption in transit, encryption at rest on AWS, MFA on production access, and Cloudflare WAF/DDoS protection.

How do I report a security vulnerability to ConsentX?

Security researchers can report vulnerabilities by emailing privacy@consentx.io. ConsentX acknowledges valid reports and works directly with researchers under a responsible disclosure process to resolve issues.

Trust

Data Breach Incident Response, DPDPA Notification & Uptime SLA

How we detect, contain and notify security incidents, and the service commitments behind ConsentX. Factual, with no certification we have not earned.

In short

ConsentX runs a defined incident-response process: detect and triage, contain, notify, eradicate and recover, then review. For a personal data breach we notify affected customers within 48 hours of becoming aware, per our DPA, and support DPDPA notification to the Data Protection Board and affected data principals. We operate to a 99.9% uptime target with a contractual SLA on Enterprise. We do not claim SOC 2 or ISO 27001, which are on our roadmap.

Data breach incident response process

1. Detect & triage

Monitoring and alerting surface anomalies. On report or alert, we triage severity and scope and open an incident with an owner.

2. Contain

We isolate affected systems, revoke or rotate credentials as needed, and stop the spread before moving to eradication.

3. Notify

For a personal data breach we notify affected customers without undue delay and within 48 hours of becoming aware, per our DPA, and support notification to the Data Protection Board and affected data principals under the DPDPA.

4. Eradicate & recover

We remove the root cause, restore from encrypted backups where needed, and verify integrity before returning to normal operations.

5. Post-incident review

Every significant incident gets a written review with root cause and corrective actions, fed back into controls and monitoring.

Security controls

Encryption

TLS in transit; storage-layer encryption at rest on AWS, including encrypted backups.

Access & network

Least-privilege access with MFA on production; Cloudflare WAF and DDoS mitigation at the edge.

Data residency

Application and consent data hosted on AWS in Mumbai (ap-south-1), India, with intra-region processing by default.

Consent integrity

Consent events are sealed in a SHA-256 hash chain, so records are tamper-evident and verifiable.

Availability & SLA

ConsentX operates to a 99.9% uptime target, measured monthly. A contractual uptime SLA with service credits is available on the Enterprise plan: contact sales for the current SLA schedule.

In the event of a ConsentX outage, the consent widget is designed to fail open, so your site's cookie banner does not block page rendering or checkout flows.

Responsible disclosure

Found a security issue? Email privacy@consentx.io. We acknowledge valid reports and work with researchers to resolve them.

Security Data residency DPA Trust

Security & incident-response questions

ConsentX