Canva Incident Response

Overview

Contain impact before debugging deeply. Distinguish provider status, application release/config, tenant authorization, endpoint throttling, async-job backlog, and preview drift.

Prerequisites

• Incident ID, severity policy, affected operations, and UTC window
• Current deployment/config revisions and last known good
• Approved test user, rollback owner, and communications channel

Instructions

Step 1: Declare and bound

Record start time, reporter, user-visible symptom, affected tenants/operations, suspected data exposure, and current severity without copying customer content.

Step 2: Contain