← Team Hub Internal SOPs · Incident response
SOP 05 · Operations

Incident response

When something is on fire — ad account paused, integration down, data leak.

Owner
Pod Lead (first), Delivery Lead (escalation)
Duration
As long as it takes
Triggers
Service down, account blocked, data exposure, client escalation

Steps

  1. Confirm and contain. Identify scope: which client, what system, what data. Pause anything that could make it worse.
  2. Notify the client within the hour. Acknowledge, no spin. “We saw it, we’re on it, we’ll update by [time].”
  3. Spin up a Slack incident channel: #inc-[YYYY-MM-DD]-[short-name]. Add Pod Lead, AI Developer on call, partner if material.
  4. Assign one driver. One person owns getting it fixed. Everyone else supports.
  5. Status updates every 2 hours until resolved — to client and in #operations.
  6. Resolve. Get the system back to normal state. Verify with the client before declaring done.
  7. Post-mortem within 5 business days. What happened, root cause, what changes so it doesn’t repeat. Filed in Drive > Operations > Incidents.
  8. Update SOPs if the post-mortem reveals a gap.
Escalation triggers

Loop in a partner immediately if: client is paying $20K+/mo, the incident touches PII, an ad account is permanently disabled, or the client mentions legal action.

← All Internal SOPs