Status pages and incident communication

Reviewers ask how you will tell them when something goes wrong. The best answer points to a status page and a written commitment, both already live.

Last reviewed 2026-09-30Written by Jacob Masse, TrazTech Inc.

Link your trust centre to a public status page for availability incidents, and publish a written commitment for security incidents: how customers are notified, through which channel, and within what time frame your contracts promise. Keep the full incident response plan gated. A reviewer wants to see that you will tell them quickly and that someone owns the process.

What is the difference between an outage and a security incident?

An outage is reported publicly on a status page as it happens. A security incident is reported privately to affected customers once confirmed, and to regulators where the law requires. Keep the two channels separate: a status page is the wrong place to announce a breach before affected customers hear directly.

What should the trust centre say?

• The status page address and what it covers.
• How affected customers are notified of a confirmed security incident, and the contractual time frame.
• A security contact for reporting suspected incidents or vulnerabilities.
• That an incident response plan exists and is tested, with the plan itself gated.

What does Canadian law require?

Under PIPEDA, an organization must report to the Privacy Commissioner and notify individuals of a breach of security safeguards involving personal information that creates a real risk of significant harm, and must keep records of all breaches. Quebec's Law 25 has a similar regime for confidentiality incidents with a risk of serious injury. As a supplier, your customer usually carries those duties and depends on your contract to hear from you promptly.

Common questions