Answer
We have no crisis plan: no source says who speaks, how fast, or what counts as a crisis, so this page holds what exists today, the kinds of failure we have already caught inside, a proposed way to answer, and the calls only Param can make.
Today
What exists
| Fact | Source |
|---|---|
| No notice system tells a brand about an incident; only a few in product messages exist | handbook customer-success-and-support/notices-to-customers |
| Alerts reach only us: Cloud Monitoring and the app's daily alerts email param@ and hello@ | brew/docs/production.md:112-115 |
| One inbox, hello@joinsquareup.com, with no response time or rota | handbook customer-success-and-support/support-process |
| A deletion request is promised within 7 days in the product; the privacy page gives no time | handbook customer-success-and-support/known-issues brew/legal-pages.js:33 |
| Arata's connections are protected in code and never disconnected | brew/tools/prod-env.sh:9 memory never-disconnect-arata-meta |
| Every direction turns the character fully off for errors on our side, money, privacy and apologies | brand-directions/docs2/data/dirs.json |
How an apology is built, in the comms books
All five comms books agree; the bee book spells it out brand-directions/bee/comms.html, how an apology is built:
- Sorry first, in two words. brand-directions/bee/comms.html, how an apology is built
- What happened, in plain words, with no blame on the founder. brand-directions/bee/comms.html, how an apology is built
- What we did, and what we changed so it does not repeat. brand-directions/bee/comms.html, how an apology is built
- An offer only a person can make. brand-directions/bee/comms.html, how an apology is built
It comes from a founder, by email, the same day we find it, with no character, no pun and no sound brand-directions/bee/comms.html, apology brand-directions/octopus/comms.html, apology for a mistake brand-directions/cooker/comms.html, apology.
Failures we have already caught inside
None of these reached the public; they show the kinds of thing that could.
| Kind | What happened | Source |
|---|---|---|
| A wrong number on a card | A COD "failed" fact was written up as "40% COD failure"; COD is now two facts, never failed | memory brew-shopify-connector-qa |
| An invented claim in a draft | A Studio piece invented "10ml" and a fake review; designed pieces are now read back | memory brew-jam-v2 |
| An unbacked health claim | Arata's stories printed "Dermat-approved formulations"; claims are now checked before drawing | handbook product-marketing/release-notes |
| A rival's creative copied | An image model copied a rival picture it was given; it now never gets the rival's picture | memory brew-go-live-2026-10-17 |
Tomorrow
| Item | Version | Tag |
|---|---|---|
| Three levels: a product error, a mistake that touched one brand, a public mistake | v1 | New, Proposed |
| A holding line ready for each level | v1 | New, Proposed |
| A notice to every affected brand inside the product | v1 | New, see notices to customers |
| Posting, measuring and ad changes each add their own failure kinds: a wrong post, a wrong result, a wrong spend | v2 to v4 | New, Proposed |
How we do it
Proposed, until Param accepts:
- Level 1, a product error that cost nothing. The product's own error line; the character may appear as a small icon only brand-directions/docs2/data/dirs.json.
- Level 2, a mistake that touched one brand's trust: a wrong number, an invented claim, data shown to the wrong person. A founder emails that brand the same day, built the four step way above. Fix it for every brand, heal saved data, then write it in Known issues.
- Level 3, a public mistake: a post, a press piece, a platform suspension, a data exposure. Param decides within one hour; one holding line goes out from Param only; partners hear before the public.
- A holding line to start from: "We got something wrong. Here is what happened, here is what we changed, and here is who to email." Fill each part with facts only.
- Never speculate, never blame a platform or a partner, never promise a date we do not control.
- A data exposure also follows the security and legal department's rules before anything is said.
Numbers
| Metric | Definition | Where measured |
|---|---|---|
| Time to first word | Minutes from finding a level 2 or 3 issue to the first email | This document's log, Proposed |
| Issues by level | Count per month | This document's log, Proposed |
| Repeats | Issues of a kind we had already fixed | Known issues, Proposed |
Open
- Who speaks in a level 3 crisis? Proposal: Param only; Sai and Arvind forward every question to him.
- How fast is the first word? Proposal: within one hour for level 3, the same day for level 2, as the comms books say.
- Do we keep a public status page? Proposal: no in the preview; email each affected brand instead.
- What do we say if Meta or Shopify suspends the app? Proposal: tell partners the same day which connector stops, that their data is safe, and that the other connectors keep reading.
- Who is the legal contact for a data exposure? No source names one. Proposal: Param names one this week.