1. Purpose and Scope
The purpose of this Service Continuity Policy / Business Continuity Policy is to establish the framework for ensuring the continuous operation of Speak AI Inc.’s (“Speak AI”) critical business functions and services in the event of a disruption. This policy applies to all employees, contractors, and third parties involved in Speak AI’s operations.
2. Policy Statement
Speak AI is committed to maintaining the availability of its services and ensuring that critical business operations can continue with minimal interruption during and after a disruption. This policy outlines the procedures and responsibilities for business continuity planning, incident response, and recovery.
3. Business Continuity Planning
- Business Impact Analysis (BIA): A BIA will be conducted to identify and prioritize critical business functions and processes. The BIA will assess the potential impact of various disruption scenarios on these functions.
- Risk Assessment: Regular risk assessments will be performed to identify potential threats to business continuity and to evaluate the effectiveness of existing controls and mitigation strategies.
- Continuity Plans: Business continuity plans will be developed and maintained for all critical functions. These plans will include detailed procedures for response, recovery, and restoration activities.
- Recovery objectives:
Our recovery point objective (RPO) is 12 hours, matching our database snapshot cadence. Customers with different requirements can discuss them as part of their agreement.
•Recovery Time Objective (RTO): Our recovery time objective (RTO) is 24 hours. This is supported by our cloud infrastructure, which runs across multiple availability zones.
4. Roles and Responsibilities
- CTO: Responsible for the business continuity program, with the CEO as executive sponsor. This includes coordinating with all relevant stakeholders.
- Department Managers: Responsible for developing, maintaining, and testing continuity plans for their respective departments. They will also ensure that their teams are trained on these plans.
- All Employees: Responsible for understanding their roles in the business continuity plan and participating in team briefings as required.
5. Incident Response and Recovery
- Incident Detection and Reporting: Any disruption or potential threat to business continuity must be reported immediately to the Business Continuity Manager. A designated incident response team will assess and categorize the incident.
- Response Procedures: The incident response team will activate the relevant business continuity plans based on the nature and severity of the disruption. This includes communication protocols, resource allocation, and coordination with external parties if necessary.
- Recovery Procedures: Detailed recovery procedures will be followed to restore critical business functions and services to normal operations. This includes data recovery, system restoration, and continuity of customer services. We engage with our clients to understand their specific operational and business needs, allowing us to configure our disaster recovery solutions accordingly.
6. Communication
- Internal Communication: Clear and effective communication channels will be established to keep all employees informed during a disruption. This includes updates on the status of the incident, response actions, and recovery efforts.
- External Communication: Communication with customers, partners, and other stakeholders will be managed to provide timely and accurate information about the impact of the disruption and the steps being taken to address it. Recovery objectives are discussed and agreed upon with clients, ensuring that expectations are clear and that Speak AI is aligned with the client’s business requirements.
7. Training and Awareness
- Awareness: Staff are briefed on continuity roles in ongoing team meetings.
8. Testing and Maintenance
- Plan Testing: Business continuity plans are reviewed annually and after significant changes. The most recent documented restore test was on 30 October 2024 (MongoDB Atlas snapshot restored to an isolated test cluster); the next is planned before the end of 2026.
- Plan Maintenance: Continuity plans will be reviewed and updated regularly to reflect changes in business operations, technology, and external threats. Lessons learned from tests and actual incidents will be incorporated into the plans.
9. Compliance and Review
- Regulatory Compliance: Speak AI will ensure that its business continuity practices comply with relevant laws, regulations, and industry standards.
- Policy Review: This policy will be reviewed annually or as needed to ensure its relevance and effectiveness. Changes to the policy will be communicated to all employees.
10. Contact Information
For any inquiries or issues related to this Service Continuity Policy / Business Continuity Policy, please contact the Business Continuity Manager at success@speakai.co.