Incident Response Policy

Last updated: 16/07/2026

Controller: Aranzazu Gamboa Andrade | Contact: hola@paqpaq.mx

 

1. INTRODUCTION AND LEGAL FRAMEWORK

This Security Incident Response Policy (the "Policy") sets out the procedures by which PAQPAQ (Aranzazu Gamboa Andrade, an individual with business activity) detects, responds to, contains, reports and resolves security incidents that compromise personal data or service availability.

This policy complies with the following legal and regulatory frameworks:

  • Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP"), published March 20, 2025.
  • Regulations to the LFPDPPP and supplementary provisions.
  • Federal Consumer Protection Law (Ley Federal de Protección al Consumidor, "LFPC").
  • Federal Tax Code (Código Fiscal de la Federación, "CFF") — tax data security obligations.
  • Resolutions of the Tax Administration Service (SAT) on CFDI security.
  • Customs regulations (General Customs Administration — AGA).
  • Terms of service of partner carriers (Skydropx, FedEx, UPS, DHL, Estafeta, Paquete Express).

 

2. DEFINITION OF A SECURITY INCIDENT

A Security Incident is any confirmed or reasonably suspected event that compromises, or potentially compromises:

  • Confidentiality: unauthorized access, exposure, leak or theft of personal, sensitive or tax data.
  • Integrity: unauthorized modification, corruption or alteration of data, CFDI files or databases.
  • Availability: unplanned service interruption, system outage, ransomware, DDoS or other events causing unavailability.

Examples of incidents: unauthorized account access, malware, successful phishing, SQL injection, data leak due to misconfiguration, API key compromise, DDoS attack, backup corruption, database outage, compromise of Digital Seal Certificates (CSD), interception of CFDI in transit.

 

3. SEVERITY CLASSIFICATION

All incidents are classified within a maximum of 2 hours from detection:

CRITICAL SEVERITY

  • Confirmed or highly likely leak of personal, sensitive or tax data of multiple users.
  • Confirmed compromise of CFDI or CSD certificates.
  • Total service outage for more than 2 hours.
  • Unauthorized access to production systems with confirmed data modification.

Required action: Activate the Critical Response Protocol (Section 5.1) immediately.

HIGH SEVERITY

  • Unauthorized access to systems without confirmed data modification.
  • Data leak affecting individual users (1-10 users).
  • Critical vulnerability detected in production code without confirmed exploitation.
  • Partial service unavailability (1-2 hours).
  • Compromise of administrative credentials.

Required action: Activate the High Response Protocol (Section 5.2) within 1 hour.

MEDIUM SEVERITY

  • Vulnerability detected in code without evidence of exploitation.
  • Anomaly in logs without confirmation of unauthorized access.
  • Repeated failed access attempts (brute force blocked).
  • Minor unavailability (< 30 minutes) resolved without data loss.

Required action: Investigation within 4 hours; notification if escalation is confirmed.

LOW SEVERITY

  • Minor security event with no potential impact on data or services.
  • Monitoring alert resolved automatically.
  • Improper access denied by security controls.

Required action: Logging and subsequent analysis; no urgent notification.

 

4. ROLES, RESPONSIBILITIES AND CONTACTS

4.1 PAQPAQ internal roles:

  • Incident Officer: Aranzazu Gamboa Andrade (owner) or designee.
    • Duties: Activate the protocol, coordinate the technical team, authorize notifications, communicate with authorities.
    • Emergency contact: hola@paqpaq.mx (response within 1 hour maximum).
  • Technical Team: developers, devops, security specialists.
    • Duties: Investigate, contain, eradicate the threat, recover data.
  • Communications Officer: hola@paqpaq.mx.
    • Duties: Draft notifications, coordinate delivery to users, carriers and authorities.

4.2 External contacts for notification (in order of priority):

  • Affected users (PAQPAQ merchants):
    • Email registered on the account + PAQPAQ dashboard + phone call (if critical severity).
  • Skydropx and other partner carriers:
    • If the incident affects the integration or data shared with them, Skydropx official contact: security@skydropx.com or the Skydropx Partners support channel.
    • FedEx, UPS, DHL, Estafeta, Paquete Express: security contact as per integration terms.
  • National Institute for Transparency, Access to Information and Personal Data Protection (INAI):
    • Website: https://www.gob.mx/inai
    • Incident report: online through the portal, or by email to direccion.general@inai.org.mx
    • Mandatory if: confirmed leak of personal data or sensitive data.
  • Tax Administration Service (SAT):
    • Contact: SAT Help Desk (01-800-601-2000) or the SAT portal (www.sat.gob.mx).
    • Mandatory if: confirmed leak or compromise of CFDI, CSD, or tax data.
  • General Customs Administration (AGA):
    • Contact: seguridad@aduanas.gob.mx (if the customs integration is affected).
    • Mandatory if: the incident affects international shipment data or customs information.
  • Federal Consumer Protection Agency (PROFECO):
    • Website: https://www.gob.mx/profeco
    • Contact: 01-800-468-8000 or online if consumer rights are infringed.
    • Mandatory if: the incident affects the rights of end users (shipment recipients) under the LFPC.

 

5. INCIDENT RESPONSE PROCESS

5.1 PHASE 1: DETECTION AND LOGGING (Hour 0 - First hour)

Who detects: Monitoring system (automatic alerts), user, customer, or external report.

Immediate actions:

  • Log the incident in a centralized log with:
    • Exact date and time of detection.
    • Description of the event.
    • Systems/data potentially affected.
    • Person(s) who reported it.
  • Notify the Incident Officer by phone (not just email) if severity is High or Critical.

5.2 PHASE 2: ASSESSMENT AND CLASSIFICATION (Hour 0-2)

The Incident Officer, advised by the Technical Team, determines:

  • Initial severity (Critical / High / Medium / Low).
  • Data potentially affected (personal, sensitive, tax).
  • Approximate number of affected users.
  • Preliminary root cause.
  • Risk of public exposure or future exploitation.

Outcome: Documented classification + activation of the corresponding protocol.

5.3 PHASE 3: CONTAINMENT (Hour 0-4 depending on severity)

Goal: Stop the incident from progressing and prevent further damage.

Actions by incident type:

  • Unauthorized access:
    • Isolate the compromised account/system.
    • Revoke all active sessions and API keys.
    • Force a password reset.
    • Block access from suspicious locations.
  • Data leak:
    • Identify the leak vector (API, database, log, cache).
    • Close public access if applicable.
    • Actively monitor public sources (pastebin, dark web) if critical.
  • Service outage:
    • Stop malicious processes or those causing abnormal resource consumption.
    • Disconnect systems from the network if necessary.
    • Activate the contingency plan (backup servers).

Documentation: Record all containment actions with a timestamp, the user who executed them and the reason.

5.4 PHASE 4: INVESTIGATION AND ERADICATION (Hour 4-24)

Goal: Understand the root cause and eliminate the vulnerability.

Actions:

  • Forensic analysis: review access logs, file changes, network traffic.
  • Timeline: reconstruct exactly what happened and when.
  • Root cause identification: vulnerability, configuration error, phishing, etc.
  • Implement a fix: security patch, configuration change, credential rotation.
  • Validate that the fix completely closes the vulnerability.

Outcome: Technical report with root cause, corrective and preventive actions.

5.5 PHASE 5: RECOVERY AND VALIDATION (Hour 4-48)

Goal: Restore normal operation with verified data integrity.

Actions:

  • Restore from a verified backup (the backup must predate the incident).
  • Validate data integrity: verify checksums and database referential integrity.
  • Functional testing: confirm that PAQPAQ works normally.
  • Gradual restoration: bring the service up in a test environment before production.
  • Intensive monitoring: watch logs and metrics for 72 hours after recovery.

Outcome: Confirmation that the service is 100% operational and data is intact.

 

6. NOTIFICATION PLAN

6.1 NOTIFICATION TO AFFECTED USERS

Maximum deadline: 72 hours after confirming a personal data leak, in accordance with the LFPDPPP.

However, initial communication must occur within 24 hours (even if the investigation is not complete).

Notification method:

  • Email address registered on the user's account.
  • Notification in the PAQPAQ dashboard (on login).
  • Phone call (if Critical severity and a confirmed leak).

Notification content (template):

---

SUBJECT: Security Incident Notification - PAQPAQ

Dear [NAME],

PAQPAQ detected and confirmed a security incident that potentially affected your personal data.

INCIDENT DETAILS:

• Incident date: [DATE]

• Detection date: [DATE]

• Incident type: [TYPE]

• Severity: [LEVEL]

DATA POTENTIALLY AFFECTED:

[SPECIFY: name, email, phone, address, RFC, payment data, etc. - BE SPECIFIC]

ACTIONS WE HAVE TAKEN:

[DETAIL: containment, investigation, fixes implemented]

WHAT YOU CAN DO:

• Change your PAQPAQ password.

• Monitor your email and tax data for suspicious activity.

• Contact us with any questions: hola@paqpaq.mx

We are offering [INCLUDE: free credit monitoring, legal advice, etc., if applicable].

We apologize for any inconvenience.

Aranzazu Gamboa Andrade

PAQPAQ - hola@paqpaq.mx

---

6.2 NOTIFICATION TO SKYDROPX AND CARRIERS

When: Within 24 hours if the incident affects the integration, shared data, or carrier credentials.

Contacts:

  • Skydropx: security@skydropx.com or the official Partners contact.
  • FedEx: as per the integration agreement.
  • UPS, DHL, Estafeta, Paquete Express: as per the registered security contacts.

Content: Technical summary of the incident, types of data affected, remediation measures, prevention plan.

6.3 NOTIFICATION TO INAI

Mandatory if: A leak of personal data is confirmed.

Deadline: Without undue delay, maximum 48 hours after the leak is confirmed.

Method: INAI online portal (https://www.gob.mx/inai/acciones-y-programas/notificacion-de-incidentes-de-seguridad).

Information to include:

  • Description of the incident.
  • Type and volume of data affected.
  • Number of data subjects affected.
  • Preliminary root cause.
  • Corrective measures implemented.

INAI will provide a case number; keep it for follow-up.

6.4 NOTIFICATION TO THE SAT

Mandatory if: A compromise of CFDI, CSD, or tax data is confirmed.

Deadline: Within 24 hours.

Contact: SAT Help Desk 01-800-601-2000 or www.sat.gob.mx.

Information: Describe how the CSD was compromised, the range of CFDI affected, and the measures taken to prevent future malicious use.

6.5 NOTIFICATION TO PROFECO

Mandatory if: The incident affects consumer rights under the LFPC.

Deadline: Within 5 business days.

Contact: https://www.gob.mx/profeco or 01-800-468-8000.

Information: Description of the incident, number of consumers affected, details of compensation or other measures offered.

 

7. TECHNICAL SECURITY REQUIREMENTS

7.1 Encryption

  • In transit: HTTPS/TLS 1.3 mandatory. All connections to PAQPAQ must be encrypted.
  • At rest: Personal and sensitive data in the database must be encrypted with AES-256 as a minimum.
  • Backups: Encrypted with AES-256 and stored in a location separate from production systems.

7.2 Logging and Auditing

  • Events to log: all access to personal data, configuration changes, authentication failures, permission changes.
  • Minimum log retention: 12 months (for incident reconstruction).
  • Log protection: Non-modifiable (append-only). Access limited to authorized personnel.

7.3 Credential and Access Management

  • Passwords: minimum 12 characters, complexity requirements, annual rotation for administrative accounts.
  • API keys: quarterly rotation, never stored in code, immediate revocation if compromised.
  • Access: Principle of least privilege. Staff only access the data necessary for their role.
  • Multi-factor authentication (2FA): Mandatory for administrative accounts.

7.4 Backups and Recovery

  • Frequency: Daily, with at least one weekly full copy and several differential copies.
  • Verification: Restore a test backup weekly to confirm integrity.
  • Location: Geographically separate from production infrastructure (to withstand disasters).
  • RTO (Recovery Time Objective): maximum 4 hours for full restoration.
  • RPO (Recovery Point Objective): maximum 1 hour of data loss in the worst case.

7.5 Monitoring and Alerts

  • 24/7 monitoring of: system access, resource consumption, errors in logs.
  • Automatic alerts for: multiple authentication failures, access from an unknown IP, unscheduled configuration changes.
  • Alert response: Human review within 30 minutes for High/Critical severity.

 

8. POST-INCIDENT COMMUNICATION

8.1 Lessons Learned

Deadline: Maximum 5 business days after the incident is closed.

The document must include:

  • Summary of the incident (what, when, how many affected).
  • Root cause.
  • Corrective actions implemented.
  • Preventive actions to avoid recurrence.
  • Changes to policies or procedures.
  • Person responsible for following up on preventive actions.

8.2 Transparent Public Communication

Within 30 days, publish a summary of the incident on the PAQPAQ blog or as a press release:

  • What happened (without exposing technical details that would enable exploitation).
  • When it was detected and resolved.
  • That affected users were notified.
  • Improvements implemented.

 

9. TESTING, AUDITS AND CONTINUOUS IMPROVEMENT

  • Response exercises: Quarterly incident simulation to validate procedures.
  • Disaster recovery testing: Monthly restoration of a test backup.
  • Penetration testing: Annually (contracted to an independent third party) to identify vulnerabilities.
  • Security audit: Annually or after a High/Critical severity incident.
  • Review of this policy: Annually and after legislative changes or incidents that reveal gaps.

 

10. COMPLIANCE AND ACCOUNTABILITY

  • Training: All PAQPAQ staff receive training on this policy at onboarding and annually.
  • Contractors/Suppliers: Must comply with this policy through clauses in integration agreements (Skydropx, Stripe, Finkok, etc.).
  • Documentation: All incidents, responses and lessons learned are documented and retained for a minimum of 6 years in accordance with the LFPDPPP.
  • Non-compliance: PAQPAQ and Aranzazu Gamboa accept legal and regulatory responsibility for non-compliance with this policy.

 

11. ANNEX: EMERGENCY CONTACTS

Incident Officer (Internal):

Aranzazu Gamboa Andrade | hola@paqpaq.mx | (Available 24/7 for Critical severity)

Affected Users:

hola@paqpaq.mx

Skydropx:

security@skydropx.com | Official Partners contact

INAI (National Institute for Transparency):

https://www.gob.mx/inai | direccion.general@inai.org.mx

SAT (Tax Administration Service):

01-800-601-2000 | www.sat.gob.mx

PROFECO (Federal Consumer Protection Agency):

01-800-468-8000 | https://www.gob.mx/profeco

Customs (AGA):

seguridad@aduanas.gob.mx (if applicable)

© 2026 PAQPAQ. Aranzazu Gamboa Andrade. All rights reserved.

Last updated: 07/16/2026