Answer with one of three honest states: yes, no, or not yet known, and back it with what you checked. Do not say "no" until you have evidence for that customer. Say what data and time range you examined, what you do not yet know, and when you will update them.
Prepare the answer before the question
Customers will ask within hours of a public notice. Build a per-customer lookup in advance of the first email: which tenant, which data types, which systems the incident touched, and during which window. Without it, support improvises.
The three answers
Yes, affected. State what categories of data, the time window, what you have done, and what the customer should do. Offer a direct contact. Be specific and plain.
No, not affected, based on evidence. Name the evidence: for example, that access logs for the affected system show no access to their tenant during the window you reviewed. Say that you will tell them if that changes.
Not yet known. This is a legitimate answer in the first days. Say what is still being analysed and give a specific next update time. Avoid vague comfort.
A short template
We are writing about the incident described on [our notice page]. For your account, we have reviewed [logs or systems] for the period [dates]. Our current finding is [affected / not affected / not yet determined]. [What data and what we are doing.] We will update you by [date]. Your contact is [name or address].
Common traps
- Answering from memory or from a sales contact's assumption.
- Saying "no customer data" when you mean "no evidence yet".
- Differences between what the status page, the email and support say. Keep one source of truth.
- Promising that it cannot happen again.
Check your claim like a reader would
Someone on the customer side will ask how you know. If your log retention is short or logging is partial, say so; that limit is part of the honest answer. The questions in what to ask when a vendor says no customer data was affected show what an informed buyer will probe.
Where Safeguard fits
Knowing which systems and dependencies each tenant touches speeds this up. Safeguard asset discovery and SBOM scanning can feed that inventory, so the lookup exists before you need it.
Quick check
Can we send the same answer to everyone?
Send a common notice, then tailor a short per-customer statement for those who ask or who are affected.
Should legal review each reply?
Have legal approve the template and the rules for when to use each answer, then let trained staff apply them.
Last reviewed: 19 October 2026.
