Breach Response (Articles 33 & 34)

1. T+0 — Awareness. Page the Privacy Operations on-call. File the incident in Aforo with severity (LOW / MEDIUM / HIGH / CRITICAL) and source (MANUAL / AUTOMATED / EXTERNAL_REPORT / SUBPROCESSOR).
2. T+30min — Contain. If the breach is ongoing (e.g. credential leak), revoke + rotate immediately. Update incident status to INVESTIGATING.
3. T+2h — Assess scope. Determine affected tenant IDs (JSONB affected_tenant_ids), data categories (affected_data_categories), approximate subject count.
4. T+6h — Notify customers (B2B). If a subset of tenant operators are affected, fire the customer notification — this satisfies your Processor obligation to inform the Controller.
5. T+12h — Aforo notifies its DPO. Internal DPO review of the incident draft. Aforo as Controller of operator data acts at this stage if operator accounts are affected.
6. T+24-48h — Draft Article 33 notification. Compose the 4-field notification (nature, DPO contact, consequences, mitigation) inline in the incident detail drawer. Save as draft.
7. T+72h — Submit to authority. Click "Mark as Article 33 Notified". Aforo stamps the authority_notified_at field. State auto-transitions to CONTAINED.
8. T+72h+ — Article 34 (if high risk). Compose subject notification. If using a public communication route, document the justification. Mark subjects_notified_at.
9. Day 7-30 — Root cause + postmortem. Add evidence, mitigation measures, prevention plan. Transition to RESOLVED.

@Component
public class MyCustomBreachDetector implements BreachDetector {

    @Override
    public String getDetectorId() {
        return "my-custom-detector-v1";
    }

    @Override
    public List<DetectionResult> detect(Instant windowStart, Instant windowEnd) {
        List<DetectionResult> hits = new ArrayList<>();

        // Your detection logic here — query audit log, usage events, etc.
        // for the [windowStart, windowEnd) window. Return one
        // DetectionResult per suspected breach.

        for (var suspect : findSuspiciousPatterns(windowStart, windowEnd)) {
            hits.add(DetectionResult.builder()
                .correlationKey(suspect.uniqueKey())           // idempotency — same key won't file twice
                .tenantId(suspect.tenantId())
                .severity(BreachSeverity.HIGH)
                .title("Suspected " + suspect.kind())
                .description(suspect.evidence())
                .affectedDataCategories(List.of("PII_EMAIL", "PII_PHONE"))
                .detectionMetadata(Map.of("tenantId", suspect.tenantId(), "rule", "high-velocity-pii"))
                .build());
        }

        return hits;
    }
}