Publish an incident notice

During a security incident, publish one verified notice that tells people which links and accounts are really yours and what you will never ask for.

Companies with a verified official channels record: exchanges, wallets, platforms and any brand that people may be contacted about during an incident.

1. Have your official channels record first. Your websites must be verified by the DNS check and your X handles by a reviewer; a notice can only list what is on that record.
2. In your dashboard, open Incident notice (under Organization). Write the title, the time the incident started in UTC, and a short plain-text summary of what happened and what people should do.
3. List your official links and tick your X handles. Each link must start with https:// and sit on one of your verified domains; handles come from your verified record and cannot be typed in. These become the only outbound links on the notice.
4. Tick the We will never lines that apply and add your own if you need to. They appear as a warning panel on the notice.
5. Save the draft, review it, then press Publish and confirm. If you already have an active notice, the confirm step warns that the new one replaces it. Share the public page: proofrail.me/notice/your-company/the-date, with its own share image.
6. Add updates as things change; each is appended to the timeline and never edited. When the incident is over, press Mark resolved and confirm. The notice stays online for reference.

Locked

Once published, the title, summary, links, handles and We will never list cannot be changed. If something is wrong, publish a new notice; it replaces the old one and both pages link to each other.

Content hash

A fingerprint of the published notice, signed with Proof Rail's key and shown on the page. It lets anyone confirm the page has not been altered.

First look

A Proof Rail reviewer reads a company's first notice within four hours of publication. It is live the whole time; the review never delays it.

• The public index of notices, where yours appears as soon as it is published.
• What readers see and how the Check it box answers them.

• Only an owner or admin of your organisation can create, publish, update or resolve a notice.
• Keep the title under 90 characters and the summary under 600. Plain text only: links and formatting are not rendered.
• Point people at the notice from your own channels. The more they check against it, the less room a message that pretends to be from you has.
• There is no charge for a notice; it comes with your official channels record.
• Every publish, update and resolve is recorded in your dashboard's audit history.