Incident Response Plan Aligned with the LGPD Standard

Introduction

At MASTERINT, safeguarding our clients' data, including Personally Identifiable Information (PII), is our top priority. Our Incident Response Plan (IRP) outlines the precise procedures our organization follows to address, manage, and mitigate security events, specifically focusing on handling database hacks, unauthorized access, and data leaks.

Incident Response Procedures

To ensure the rapid containment of threats and compliance with our partners' data protection policies, including Amazon’s Acceptable Use Policy (AUP) and Data Protection Policy (DPP), MASTERINT follows a strict 5-step protocol:

1. Identification & Triage

We employ continuous monitoring tools across our network and database infrastructure to detect anomalies. Upon detecting potential unauthorized access, suspicious database queries, or signs of a data leak, our IT Security team is immediately alerted to assess the scope, severity, and nature of the incident.

2. Immediate Containment

Our immediate priority is to stop the spread of the threat and prevent further data exposure. Affected systems, networks, or databases are instantly isolated. Our containment measures include:

• Revoking compromised or suspected user credentials.

• Blocking unauthorized or suspicious IP addresses.

• Temporarily disabling affected API integrations and access tokens.

3. Notification & Compliance

Transparency and rapid communication are fundamental to our security posture. If an incident involves any Amazon Personally Identifiable Information (PII) or Amazon platform data, MASTERINT guarantees that the Amazon Security Team will be notified via email (security@amazon.com and 3p-security@amazon.com) within 24 hours of incident detection. We will also notify any other affected clients and applicable regulatory authorities in accordance with global data protection laws. em até 24 horas após a detecção do incidente. Também notificaremos outros clientes afetados e as autoridades reguladoras competentes, em conformidade com a LGPD e outras leis globais de proteção de dados.

4. Eradication & Recovery

Following containment, our technical team investigates the root cause of the breach. We eradicate the threat by removing malicious code, closing vulnerabilities, and applying necessary security patches. Once the environment is sanitized and secured, systems are systematically restored using encrypted, uncompromised backups to ensure business continuity.

5. Post-Incident Review

After the threat is neutralized and normal operations resume, our security team conducts a comprehensive post-incident audit. We document the timeline, the root cause, and the effectiveness of our response. The insights gained are used to upgrade our security controls, update firewall rules, and provide additional training to our staff to prevent recurrence.

Contact

For any questions regarding our data security practices or to report a security vulnerability, please contact our Data Protection Officer / Security Team at security@masterint.com.