Security Incident and Data Breach Policy

1. Purpose and Scope

This Security Incident and Data Breach Policy describes Spark Rack’s public commitments and general process for receiving, containing, investigating, documenting, remediating, and communicating suspected security incidents affecting Spark Rack systems or information.

1. All Spark Rack Customers and prospective Customers;
2. All End Users, authorized users, administrators, and account contacts;
3. All Spark Rack websites, portals, control panels, networks, servers, storage systems, software, and Services;
4. All resellers and downstream customers where applicable;
5. All Customer Data and Customer Content processed through the Services; and
6. All third-party providers used to support an applicable Service.

This public Policy does not disclose confidential technical controls, internal contacts, forensic methods, credentials, or response playbooks.

2. Definitions

2.1 Security Event

An observable occurrence that may be relevant to security but has not been confirmed as harmful.

2.2 Security Incident

A confirmed or reasonably suspected event that threatens confidentiality, integrity, availability, authentication, authorization, privacy, or lawful operation.

2.3 Data Breach

A Security Incident involving unauthorized acquisition, access, use, disclosure, alteration, loss, or destruction of protected information, as defined by applicable law.

2.4 Customer Incident

An incident primarily affecting Customer-controlled systems, applications, credentials, or Customer Content.

3. Security Is a Shared Responsibility

Spark Rack maintains reasonable administrative, technical, and physical safeguards appropriate to the Services.

No company can guarantee prevention or immediate detection of every attack, error, insider act, software defect, hardware failure, or unauthorized disclosure.

Customer remains responsible for Customer-controlled applications, credentials, access, software updates, configuration, data classification, End Users, backups, and incident response within Customer’s environment.

4. Reporting a Suspected Incident

A suspected incident should be reported promptly through the Spark Rack security or support channel.

A report should include:

1. The affected Account, Service, domain, IP address, system, or user;
2. The date, time, and time zone;
3. A clear description of the suspected event;
4. Observed indicators, errors, alerts, or unauthorized changes;
5. Relevant logs or screenshots;
6. Whether credentials or data may be involved;
7. Actions already taken;
8. Whether the incident appears ongoing;
9. A reliable contact; and
10. Any immediate safety, legal, or operational concern.

5. Initial Triage

Spark Rack may assess:

1. Whether the event is credible;
2. Whether the event is ongoing;
3. Which systems and information may be affected;
4. Whether Customer systems or shared infrastructure are involved;
5. Whether immediate containment is required;
6. Whether a third-party provider is involved;
7. Whether forensic assistance is appropriate;
8. Whether legal counsel should be involved;
9. Whether evidence must be preserved; and
10. Whether notification obligations may apply.

6. Containment Actions

Spark Rack may take immediate actions reasonably necessary to contain risk, including:

1. Restricting or disabling access;
2. Resetting passwords;
3. Revoking sessions, tokens, keys, or certificates;
4. Blocking addresses, ports, protocols, domains, or traffic;
5. Isolating a server or network segment;
6. Disabling a compromised feature;
7. Stopping a process or Service;
8. Taking a system offline;
9. Preserving logs and snapshots;
10. Changing routes or DNS;
11. Requiring Customer action;
12. Suspending an Account;
13. Contacting providers or authorities; and
14. Taking other protective measures.

Containment may temporarily interrupt legitimate activity.

7. Preservation of Evidence

Spark Rack may preserve relevant logs, system images, snapshots, configuration, communications, access records, and other evidence.

Personnel and Customers must not knowingly destroy, alter, conceal, or overwrite evidence after receiving a preservation instruction.

Preservation does not guarantee forensic completeness or legal admissibility.

8. Investigation

An investigation may examine:

1. Initial access method;
2. Affected accounts and systems;
3. Malware or unauthorized tools;
4. Credential use;
5. Privilege escalation;
6. Persistence;
7. Lateral movement;
8. Data access, acquisition, alteration, or deletion;
9. Network activity;
10. Logs and monitoring alerts;
11. Provider records;
12. Customer actions;
13. Software vulnerabilities;
14. Human error;
15. Timeline and duration; and
16. Containment and recovery status.

Spark Rack may engage legal counsel, forensic specialists, insurers, vendors, data centers, registrars, carriers, law enforcement, or other appropriate parties.

9. Incident Classification

Not every security alert is a Data Breach. Spark Rack may classify an event based on evidence, information type, authorization, likelihood of access, legal definitions, encryption, acquisition, risk of harm, and other circumstances.

Classification may change as new evidence becomes available.

10. Customer-Controlled Incidents

When an incident originates in Customer-controlled software, credentials, configuration, content, users, or devices, Customer is responsible for containment and remediation within that scope.

Spark Rack may assist on a best-effort or billable basis and may impose protective restrictions on affected Services.

Customer must not reconnect or restore a compromised system until reasonable remediation has occurred.

11. Third-Party Incidents

A Security Incident may involve a data center, carrier, payment processor, registrar, software provider, cloud provider, support platform, or other vendor.

Spark Rack may rely on provider information while conducting its own reasonable assessment.

Spark Rack cannot guarantee third-party investigation speed, disclosure, remediation, or evidence availability.

12. Eradication and Remediation

Remediation may include:

1. Removing malicious software;
2. Reinstalling systems;
3. Applying patches;
4. Correcting configuration;
5. Rotating credentials and keys;
6. Revoking unauthorized access;
7. Changing firewall or network rules;
8. Replacing hardware;
9. Disabling vulnerable features;
10. Updating monitoring;
11. Restoring data;
12. Rebuilding from trusted sources;
13. Updating procedures;
14. Training personnel; and
15. Reviewing provider relationships.

No remediation can guarantee that every persistence mechanism, stolen copy, undiscovered weakness, or future attack has been eliminated.

13. Recovery and Return to Service

Spark Rack may restore systems gradually and may require validation before normal access resumes.

Recovery may include heightened monitoring, temporary restrictions, forced password resets, feature limitations, traffic filtering, backup restoration, or migration.

Service availability and data recovery remain subject to the SLA and Data Backup Policy.

14. Notification Assessment

Spark Rack will evaluate whether notification to Customers, individuals, regulators, insurers, law enforcement, or other parties is required or appropriate.

The assessment may consider applicable law, contractual roles, data type, encryption, likelihood of acquisition, risk of harm, number and location of affected persons, law-enforcement requests, and the status of the investigation.

15. Customer Notification

When legally required or otherwise appropriate, Spark Rack will provide affected Customers with information reasonably available and appropriate to the circumstances.

A notice may describe:

1. The general nature of the incident;
2. The date or approximate period;
3. The affected Service or information categories;
4. Actions Spark Rack has taken;
5. Actions Customer should take;
6. Available support or protective resources;
7. Known limitations of the investigation; and
8. A contact method for questions.

16. Timing of Notification

Notification timing depends on applicable law, investigation, containment, evidence, provider coordination, data scope, and law-enforcement restrictions.

Spark Rack will not intentionally delay a legally required notice for public-relations convenience.

Spark Rack may delay details that are unconfirmed, security-sensitive, legally restricted, or likely to impede containment or investigation.

17. Customer Responsibilities After Notice

Customer may be required to:

1. Reset passwords and rotate credentials;
2. Review user access;
3. Preserve logs and evidence;
4. Patch or rebuild Customer systems;
5. Notify Customer’s End Users or regulators;
6. Consult legal counsel;
7. Review payment or identity information;
8. Enable multifactor authentication;
9. Review backups;
10. Monitor for misuse;
11. Provide accurate contact information; and
12. Follow reasonable security instructions.

Customer is responsible for notification obligations arising from Customer’s role as controller, business, employer, merchant, covered entity, school, public body, or other regulated party.

18. Communication During an Active Incident

Spark Rack may provide updates through the Customer Portal, support tickets, email, status page, or other reasonable channels.

Updates may be delayed while personnel focus on containment, evidence preservation, recovery, or legal review.

Estimated times and preliminary causes are not guarantees and may change.

19. Confidential and Restricted Information

Spark Rack may withhold exploit details, credentials, network diagrams, detection rules, another Customer’s information, privileged advice, provider-confidential information, or facts restricted by law.

Customer must protect incident information that could facilitate further attack or expose another person.

20. Law Enforcement and Emergency Cooperation

Spark Rack may contact or cooperate with law enforcement, emergency services, regulators, child-safety organizations, or other authorities when required by law or reasonably necessary to address serious harm, crime, exploitation, or immediate danger.

Spark Rack may preserve and disclose information according to applicable law and the Law Enforcement and Legal Request Guidelines.

21. No Admission of Fault

Investigating, containing, notifying, providing assistance, or offering protective resources does not by itself constitute an admission of negligence, liability, legal violation, or contractual breach.

22. Costs and Professional Services

Spark Rack bears its own ordinary costs for incidents within Spark Rack-controlled infrastructure, subject to contracts and insurance.

Customer may be responsible for costs arising from Customer-controlled compromise, extraordinary restoration, forensic work, legal requests, malware cleanup, reinstallation, third-party charges, or repeated noncompliance when permitted by the Terms of Service.

23. Incident Records and Retention

Spark Rack may retain incident reports, logs, evidence, communications, findings, notification decisions, remediation records, and related information for security, legal, insurance, audit, fraud-prevention, and operational purposes.

Retention does not mean every raw log or data source will remain available indefinitely.

24. Lessons Learned

After a material incident, Spark Rack may review cause, detection, containment, communication, recovery, vendor performance, documentation, and corrective actions.

Spark Rack may update safeguards, training, architecture, monitoring, or policies based on the review.

25. No Absolute Security Guarantee

Spark Rack does not guarantee that every attack, compromise, unauthorized access, data loss, malware infection, insider act, software defect, or disclosure will be prevented or detected immediately.

Reasonable safeguards reduce risk but cannot eliminate all risk.

26. No AI Use

Spark Rack does not use Customer incident data, breach records, logs, evidence, or communications for AI or machine-learning training and does not authorize third parties to do so.

Automated rule-based security tools may be used for fixed signatures, thresholds, rate limits, and alerts consistent with the Artificial Intelligence Policy.

27. Contact

Suspected incidents should be reported through the security channel in the Customer Portal or published security-reporting method.

Spark Rack
Attn: Security Incident Response
PO Box 2215
Valdosta, GA 31604
United States

28. Acknowledgment

By using the Services, Customer acknowledges that:

1. Security is a shared responsibility.
2. No provider can guarantee prevention or immediate detection of every incident.
3. Spark Rack may restrict or suspend Services to contain risk.
4. Customer must secure Customer-controlled systems and cooperate with investigation and remediation.
5. Not every Security Event is legally a Data Breach.
6. Notification depends on applicable law, evidence, risk, and contractual roles.
7. Spark Rack may preserve evidence and cooperate with appropriate authorities.
8. Recovery may require reinstallation, credential rotation, restoration, or permanent Service changes.
9. No remediation guarantees that all risk has been eliminated.