The principal objective of the Escalation Protocol is to ensure a consistent methodology for handling a diverse set of incidents across Ripple Treasury’s operating boundaries, allowing for resolution and communication as quickly as possible.
Identification
Incidents can be identified in a variety of manners, the most common of which being via phone or email communications from clients or system generated alerts.
The initial point of contact should establish whether the incident warrants further investigation as well as the proper severity level.
Ticket Creation
Once an incident has been identified as valid for pursual (not every incident will generate a ticket), it should be documented in the ticketing system. The ticket will serve as the audit trail and repository of progression in the resolution of said incident. The ticket should be assigned to the proper group, with the appropriate importance/severity identified.
Severity Criteria
Depending on the severity of a given incident, the protocol for handling the incident and/or the escalation of the incident may differ. Severity criteria can be classified into one of the following buckets:
Severity Level 1 is defined as the inability to use any major functions of the application, resulting in a critical impact on client daily objectives with no workaround. Ripple Treasury will respond to the affected customer within 30 minutes of receiving the notification of a Severity Level 1 issue during business hours or within 1 hour during after-hours support coverage. Ripple Treasury will work to resolve the issue in 4 hours or less and the affected customer will receive notification upon resolution.
Severity Level 2 is defined as important existing application functionality that is not available to the client with no acceptable workaround. These items require same day attention. Ripple Treasury will respond within 1 hour of receiving a Severity Level 2 issue during business hours or within 2 hours during after-hours support coverage. Ripple Treasury will work to resolve the issue in 8 hours or less and the affected customer will receive notification upon resolution.
Escalation Criteria and Escalation Role Descriptions
Depending on the severity of a given incident, the protocol for handling the incident itself and/or the escalation of the incident may differ. Upon the creation of a Severity Level 1 or Severity Level 2 ticket, management of the teams involved in the resolution, coordination or communication of the incident should be notified via email.
A Severity Level 1 or 2 impacting security, privacy, or compliance related matters, should prompt communications to the Security & Compliance team. If the incident is deemed serious, the Security & Compliance team should be contacted immediately via phone.
Communication and Notification Process
There are two types of communications that are possible during an incident:
Internal communication
External communications to customers
Internal Communication
Communication to the appropriate teams should be initiated immediately after the creation of a ticket. The Incident Commander is responsible for communicating with the internal team based upon the identified process.
External Communication
The initial Ripple Treasury point of contact should continue to coordinate the incident to resolution unless verbally handing over ownership to another employee.
Follow-up
Post -mortem meetings should be held on all Severity Level 1 and Severity Level 2 issues. Post-mortem summary information may be shared with affected customers upon the removal of sensitive personal, technical or confidential information.
Copyright 2025 Ripple Labs Inc.