Security Incident Notification Process for SaaS¶

Version: 1.1

WSO2 notifies SaaS subscribers of confirmed security incidents so impacted customers can take any necessary action. This page documents the notification commitments by subscription tier. The broader cloud incident-management process, covering protocols, response teams, severity-driven escalation, and stakeholder communication, is documented in Cloud Security Process: Incident Management.

Paid Subscribers¶

Paid SaaS subscribers receive notification of confirmed security incidents within 48 hours of confirmation, with the information needed to assess impact and act.

Free Subscribers¶

Free-tier subscribers are notified of security incidents at WSO2's discretion, on a case-by-case basis.