← Back to forvalt
Breach Notification Procedure
Last updated: April 3, 2026
This document outlines forvalt's procedure for identifying, responding to, and notifying affected parties in the event of a personal data breach, in compliance with GDPR Articles 33 and 34.
1. Definition of a Personal Data Breach
A personal data breach is a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
Examples relevant to forvalt:
- Unauthorized access to the Supabase database containing encrypted user states
- Compromise of server-side API keys or Telegram bot token
- Unauthorized access to Redis containing user metadata
- Exposure of Stripe customer IDs or subscription records
- Accidental disclosure of user data through admin endpoints
2. Detection and Initial Assessment
2.1 Detection sources
- Automated monitoring (Vercel logs, Supabase audit trails, Redis access logs)
- Error reporting to admin Telegram chat (via sentry.ts)
- User reports via
/support or /bug
- Third-party notifications (Stripe, Supabase, Redis security advisories)
2.2 Initial assessment (within 4 hours)
Upon detection of a potential breach, the operator will:
- Confirm whether a breach has occurred
- Identify the nature and scope of the breach
- Determine what personal data is affected
- Assess the number of affected users
- Evaluate the likely risk to affected individuals
3. Containment
Immediate containment measures include:
- Rotating compromised API keys and tokens (Supabase, Redis, Stripe, Telegram bot)
- Revoking admin sessions and regenerating admin authentication codes
- Blocking compromised IP addresses or user agents
- Taking affected services offline if necessary
- Preserving evidence for investigation (logs, access records)
4. Notification to Supervisory Authority (within 72 hours)
If the breach is likely to result in a risk to the rights and freedoms of individuals, the operator will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Article 33).
The notification will include:
- Nature of the breach (categories and approximate number of data subjects and records)
- Name and contact details of the operator
- Likely consequences of the breach
- Measures taken or proposed to address the breach and mitigate its effects
Risk mitigation by design: Because forvalt encrypts all financial data with AES-256-GCM on the client side before server storage, a database breach would expose only encrypted ciphertext that cannot be read without the user's encryption key. This significantly reduces the risk to individuals even in the event of unauthorized database access.
5. Notification to Affected Users
If the breach is likely to result in a high risk to the rights and freedoms of individuals, affected users will be notified without undue delay (GDPR Article 34).
5.1 Notification channels
- Primary: Telegram message via @forvalt_bot
- Secondary: In-app notification upon next App open
- Fallback: Public announcement on the landing page
5.2 Notification content
- Description of the breach in clear, plain language
- What personal data was affected
- Likely consequences
- Measures taken to address the breach
- Recommended actions for users (e.g., changing passphrase, reviewing account)
- Contact information for further questions
5.3 Exceptions
User notification is not required if (Art. 34(3)):
- The data was rendered unintelligible (encrypted) and the encryption keys were not compromised
- Subsequent measures ensure the high risk is no longer likely to materialize
6. Post-Breach Review
Following any breach, the operator will:
- Document the breach, its effects, and remedial actions in an internal breach register
- Conduct a root cause analysis
- Implement corrective measures to prevent recurrence
- Update security procedures and this document as needed
- Review and update the Data Protection Impact Assessment if applicable
7. Breach Register
All breaches (including those not requiring notification) are documented in an internal register containing:
| Field | Description |
|---|
| Date detected | When the breach was first identified |
| Date reported | When authorities/users were notified |
| Nature | Type of breach (confidentiality, integrity, availability) |
| Data categories | What personal data was affected |
| Approximate records | Number of records/individuals affected |
| Risk assessment | Likely impact on individuals |
| Containment | Actions taken to stop the breach |
| Remediation | Long-term fixes implemented |
8. Contact
To report a suspected security incident or data breach:
See also: Privacy Policy · Data Protection Impact Assessment