Send a short written summary, not your internal postmortem. Include what happened, what your investigation confirmed about their data or service, what you did, and what you are changing. Keep names, internal system details and unconfirmed theories out, and have your legal adviser review it.
Why not send the internal document
Your internal postmortem is written for learning. It may name systems, tools and weaknesses in detail, and it contains open questions. A customer needs something different: assurance about their exposure and about your control. Sharing the internal version can create new risk and may not answer what they asked.
Public or customer facing postmortems follow different rules from internal ones, as the SRE guidance on sharing widely also notes with regard to protecting user identifying information.
What the customer usually wants to know
- Were we affected, and how do you know?
- Is the issue contained?
- What changed so it does not happen again?
- When will you tell us more?
Answer those four in that order.
A reply structure that works
| Section | Content |
|---|---|
| Summary | Two or three sentences, dated |
| Impact on you | What was and was not affected, with the basis for each |
| What we did | Containment, recovery, credential rotation where relevant |
| Cause | The contributing conditions, stated plainly |
| What changes | Actions with target dates |
| Next update | A date and a contact |
Keep it to a page. Offer a call for questions, but put the substance in writing so it can be filed.
Rules for the wording
- Say "we found no evidence" only with the scope of the check.
- Do not claim certainty you lack. List open items and a date for the next update.
- Avoid blaming the upstream project or maintainer. State the fact of the event and your own response.
- Do not promise outcomes you cannot control, such as "this will never happen again".
- Do not speculate about who was behind it.
Keep a single source of truth
Have one owner draft the reply from the postmortem, and one approver sign it off. Send the same facts to every customer who asks, adjusted only for their specific exposure. Inconsistent answers across customers are noticed, especially when they compare notes.
If a contract sets a notice period or format, check it with your legal adviser first. This article is not legal advice.
Follow up
Add the request to your incident record. Note which customers asked, what you sent and when. If you promised an update, put it in the calendar. Silence after a promise does more damage than the original incident.
Quick check
Can we share the internal postmortem under NDA?
You can, but ask first whether it helps. A tailored summary is usually safer and answers the question better. Check with your legal adviser.
What if our investigation is not finished?
Say so, share what is confirmed, and give a date for the next update.
Sources
Last reviewed: 19 October 2026.
