Resilience & Operations
Security Monitoring & Incident Response​
Continuous Security Monitoring​
Definity maintains 24/7 security monitoring practices designed to identify suspicious activity, unauthorized access attempts, anomalies, and potential security events.
Cloud-native and infrastructure monitoring capabilities provide visibility into system activity and help identify potentially risky configurations or behavior.
Logging​
Relevant security and operational events are logged to support:
- Security monitoring
- Investigation
- Incident response
- Troubleshooting
- Operational visibility
- Compliance requirements
Security and operational logs are retained according to their classification and purpose, with a current retention period of 12 months.
Incident Response​
Definity maintains processes for detecting, assessing, responding to, containing, investigating, and recovering from security incidents.
Our incident response lifecycle includes:
- Detection
- Assessment
- Classification
- Containment
- Investigation
- Eradication or remediation
- Recovery
- Post-incident review
Security incidents are evaluated according to severity and potential impact, with appropriate internal stakeholders engaged based on the nature and scope of the event.
Incident Notification​
Where a security incident affects customer information and notification is required by applicable law or contractual commitments, Definity follows the applicable notification requirements.
Incident Testing & Readiness​
Definity reviews and exercises its incident response capabilities to help ensure that roles, escalation paths, communication procedures, and response processes are understood and operationally ready.
Significant security events are reviewed to identify lessons learned and opportunities to strengthen controls and processes.
Business Continuity & Disaster Recovery​
Operational Resilience​
Enterprise customers depend on reliable technology and resilient services.
Definity's business continuity and resilience practices are designed to support continued operation and recovery during disruptive events.
Business continuity is incorporated into our broader operational risk-management program.
Business Continuity​
Definity maintains processes designed to identify critical dependencies, evaluate disruption scenarios, and support continuity of important business and technology functions.
Disaster Recovery​
Definity maintains defined recovery objectives for applicable services.
| Objective | Target |
|---|---|
| Recovery Time Objective (RTO) | 1 hour |
| Recovery Point Objective (RPO) | 24 hours |
These are recovery targets and may vary depending on the nature, scope, and underlying cause of a disruption.
Backup Strategy​
Definity maintains automated backup processes designed to support data protection and recovery.
Backup frequency: Daily
Backup retention: 7 days
Backup activity is monitored, and failures are addressed through established operational processes.
Disaster Recovery Testing​
Definity tests its disaster recovery capabilities at least annually.
Testing includes technical recovery activities and a cybersecurity simulation designed to exercise response to security-related disruption scenarios.
Exercises assess:
- Recovery procedures
- Technical recovery
- Communication
- Escalation
- Roles and responsibilities
- Dependencies
- Response effectiveness
- Potential control gaps
Findings are evaluated and incorporated into applicable resilience and security improvements.
Service Status & Availability​
Definity AI is designed for reliable, resilient operation and maintains operational processes to monitor service health, detect incidents, and respond to availability-impacting events.
Service Availability​
Availability is supported through resilient cloud infrastructure, continuous monitoring, incident response procedures, backup and recovery processes, and business continuity and disaster recovery planning.
Customers can request service availability information and relevant availability documentation by opening a support ticket. Our team can provide the appropriate information based on the customer's needs and access requirements.
Service Status & Incident Communication​
For service-impacting incidents, Definity AI follows established incident response and communication procedures. Customers are provided with relevant updates throughout investigation and recovery, as appropriate to the nature and impact of the incident.
For availability inquiries, historical availability information, or service-status documentation, customers may open a support ticket with the Definity AI team.