No incidents to report
There have been no customer-affecting security incidents — read with the obvious caveat: the product is new, and a clean record without many customers isn’t much of a record. What follows is the commitment, made now rather than afterwards.
Committed in advance
What we'll publish when something goes wrong
A disclosure commitment made before the first incident is worth something. One written after it is a press release.
Within 72 hours
What happened, which data, how many workspaces — even where no law requires it.
Direct notice
Every affected workspace is emailed, not left to find a status update.
A real root cause
What was misconfigured, why the guard missed it, what now catches it.
What we got wrong
Including where we were slow to detect or slow to tell you.
Nothing removed
Entries stay. A page that gets shorter over time is one nobody should read.
Downtime goes elsewhere
Outages with no data involved are on the status page, not here.
Where to look