# ETP Foundry: incident response

**Draft v0.2, pending counsel review, 19 October 2026**

> **In short.** Incidents are graded S1 (a wrong value, a missed value, unauthorised access or a lost key), S2 (an outage or late value) or S3 (a defect with no effect). For an S1 we e-mail affected sponsors and seat holders within 2 hours, post on the status page within 24 hours and send a post-mortem within 5 business days. A wrong value is corrected by a new record; the original is never deleted. ETP Foundry is run by one person today, with no paging tool.

> **What changed from v0.1.** Restated for the fund model: "licensees" are now the fund sponsors and seat holders; a missed value means a NAV not signed by its deadline (instead of no value at a strike); containment stops the NAV scheduler (instead of the strike runner); and a wrong value is corrected under the Methodology v1.1 correction policy. The commitments and timings are unchanged.

How ETP Foundry classifies, handles and discloses incidents. ETP Foundry is operated by one person today. This policy states commitments that one person can keep.

## 1. Severity

| Severity | Examples |
|---|---|
| **S1** | A wrong NAV or fund action proposed or published; a NAV missed through a fault of ours; unauthorised access to a system or to personal data; loss of a signing key |
| **S2** | A service outage without a wrong value (desk, API, MCP or validator down); a late NAV; a failed security control found before exploitation |
| **S3** | A defect with no effect on values or data; a display error on the website |

## 2. Commitments

| | S1 | S2 | S3 |
|---|---|---|---|
| Fund sponsors and seat holders notified (e-mail) | within **2 hours** of detection | within 1 business day, if they are affected | not required |
| Public status entry (etpfoundry.com/status) | within **24 hours** | within 2 business days | in the next update |
| Written post-mortem | within **5 business days**, sent to affected sponsors and seat holders; a summary is published | on request | not required |

## 3. Procedure

1. **Detect and record** the time found and who found it.
2. **Contain**: stop the NAV scheduler, roll back the service revision, revoke keys or rotate secrets as needed. Any seat allowed to may also pause creations and redemptions for up to 72 hours (Methodology v1.1 §6.4).
3. **Errors follow the Methodology**: a wrong value is corrected by a new record under the same quorum, and the original is never deleted (Methodology v1.1 §6.6); a late value keeps its valuation point and is labelled late.
4. **Notify** as above. A personal-data breach that creates a real risk of significant harm is also reported to affected individuals and the Office of the Privacy Commissioner of Canada, and a record of every breach is kept, as PIPEDA requires.
5. **Post-mortem**: what happened, impact, root cause, the control added, and what is still open.

## 4. Record

Every incident is listed on etpfoundry.com/status with its date and a factual description, and in the quarter's committee minutes. Incidents are not removed from the record once they are fixed.

## 5. Contacts

Report a security issue to security@etpfoundry.com. Everything else goes to hello@etpfoundry.com.

## 6. Limits, stated

There is no paging tool and no second on-call person. Detection relies on the admin console's alerts and on daily manual checks. The notification times above run from when an incident is detected.

Lucilla, Inc., federal corporation no. 16699448, Toronto, trading as ETP Foundry.