The service no longer responds.
Server errors, an unavailable journey, authentication problems or failed transactions. We start by identifying what is genuinely affected.
SOS / PRODUCTION INCIDENTQUALIFY → RESPOND → VERIFY
IT TROUBLESHOOTING & EMERGENCIESProduction
Production
stops.
Your business does not.
An unavailable service, a blocked release, a degraded database or an attack under way: one technical contact to organise the response and contain the impact.
Availability and response time are confirmed after qualification.
RESPONSE PROTOCOL
RESPONSE PROTOCOLRGAIX / SOS
01
Understand the impact
Affected services · users · timeline
02
Organise the response
People · access · authorised actions
03
Restore and verify
Remediation · business journeys · monitoring
04
Prevent recurrence
Report · causes · lasting actions
TO MOVE FASTERGive us the facts.
Give us the facts.
We prepare the call.
The form structures the affected service, the impact, the timeline and how to call you back. For an attack, describe only the symptoms observed and the systems involved.
Direct line: +33 7 67 46 80 46WHAT BRINGS YOU HEREAn incident can take
An incident can take
several shapes.
The release degraded the service.
Regression, incompatibility, configuration or dependency: the latest changes help direct the investigation and study a restoration.
The system becomes unstable.
Resource saturation, slowness, database errors or breaks between services: the intervention accounts for the dependencies and the access available.
PASSIVE & ACTIVE SECURITYAn attack is under way.
An attack is under way.
Contain before it worsens.
We can work on preventive defence and on the response to an attack under way, within the scope of your systems and with explicitly authorised actions.
Passive defence
Collecting and reading logs, monitoring, hardening, isolated backups, access control, detection of indicators of compromise and preparation of procedures.
Active response
Isolating hosts, blocking indicators, revoking sessions, preserving useful evidence, controlled eradication and progressive recovery under watch.
No “hack back”. Active intervention means defence and containment on the environments you control. Depending on the nature of the attack, we coordinate the specialist skills and notification obligations required.
THE FRAME OF THE INTERVENTIONAct fast.
Act fast.
Keep a record.
Speed must not create a second incident. We organise the exchanges, the authorisations and the tracking of actions during remediation.
Prepare the report01
A contact who decides
Identify someone able to confirm the business impact, organise access and approve the actions that change the system.
02
A shared timeline
We line up the symptoms, the recent changes and the first actions. Hypotheses stay separate from observed facts.
03
Coordinated actions
Operations are prioritised by impact and by the ability to roll back. Concurrent changes are avoided as far as possible.
04
A verified recovery
An HTTP response is not enough: the affected journeys must be checked with your people before declaring the service restored.
EXAMPLE DELIVERABLER / TECH
The intervention report
TimelineEvents and decisions
ImpactServices and journeys affected
ActionsOperations performed and results
CauseEstablished or still to be confirmed
NextFixes and prevention
Scope • Decisions • Owners • Validation
AFTER THE RECOVERYClose the incident.
Close the incident.
Address what made it possible.
The review separates the immediate fix from the lasting changes: observability, capacity, tests, deployment procedure or backups.
If the context calls for it, we then frame an audit, maintenance or on-call support. That continuation remains a scope of its own, distinct from the emergency.
Maintenance & continuity ↗BEFORE YOU CALL
The four useful pieces of information.
| Information | How to phrase it |
|---|---|
| Impact | The ordering journey fails for every user. |
| Start | The incident has been observed since this time, in this time zone. |
| Changes | A version or a configuration was changed before the incident. |
| Contact | Here is the technical contact and the person who can authorise actions. |
GOOD TO KNOW
Never send a secret through a public form. Access is organised through a suitable channel. A suspected compromise requires an explicitly qualified scope and skill set.
Can you step in without an existing maintenance contract?
A one-off intervention can be considered once the system, the incident and the required access have been qualified. Scope and conditions are agreed before we start.
What should we prepare?
The start time, the affected services, the latest changes and a technical contact. Never send a password or any secret through the form.
What happens after the emergency?
We propose a review, durable fixes and, if needed, ongoing maintenance or support for your infrastructure.
CONCRETE EXAMPLE / SCENARIO
An order platform unavailable after a release.
Distribution SME / business application
Illustrative scenario, not attributed to a real client.
01 / The starting situation
Sales teams can no longer validate orders. A new version was deployed shortly before the first reports; the cause is still to be established.
02 / Our intervention
Qualify the affected journeys, line up the timeline of changes, work through the restoration with the team and verify orders end to end.
03 / What would be delivered
A restored and checked service, a timeline of the intervention, the actions taken and a plan to address the established causes.
An incident under way?
Let’s start with its impact and the technical context.