When a SaaS vendor discloses a zero-day, ask whether your tenant was exposed, what data it held, when the fix landed and what evidence they have. On your side, rotate tokens and keys connected to the service, review its access logs, and check your contract and regulatory duties.
You cannot patch it, but you can act
The vendor patches their platform. Your job is to learn the impact on you and to protect what you control: the integrations, API keys, user accounts and exported data that tie your systems to theirs.
Questions to send the vendor
- Was our tenant or data exposed, or only the platform at large?
- What period does the exposure cover, with dates?
- Which data categories were reachable?
- Has the fix been applied to our environment, and when?
- What logs can you give us for our tenant?
- Do we need to rotate credentials or reauthorize integrations?
- When is your next update?
Put the questions in writing and log the answers with times.
Your own checklist
| Action | Why |
|---|---|
| Rotate API keys and tokens issued to the vendor | Stolen tokens outlive the patch |
| Revoke and reauthorize OAuth grants | Same reason |
| Review sign-in and admin logs on your tenant | Look for unfamiliar activity |
| Check connected systems for new data pulls | Spot abuse of integrations |
| List what personal data the vendor holds for you | Feeds notice decisions |
Legal clocks
If the vendor holds personal data for you and a breach occurred, you may be the controller. Under GDPR Article 33 the controller notifies the supervisory authority without undue delay and where feasible within 72 hours of becoming aware, and a processor must alert the controller without undue delay. Under NIS2 Article 23, essential and important entities report significant incidents with an early warning within 24 hours. Ask counsel when your clock starts. See breach notification after a zero-day.
Learn for next time
Add your vendors to an inventory with the data they hold and the integrations they have. Record who owns each relationship. The first hour of the next event will be much faster.
What a good vendor answer looks like
A useful reply gives dates, scope and evidence, and says plainly what is still unknown. Be wary of replies that only say the issue is resolved. If answers are slow, escalate through your account contact and note the delay in your log, since it may matter to your own notice duties.
Quick check
Who starts the 72 hour GDPR clock when a processor is breached?
The controller's duty runs from when it becomes aware of the breach. The processor must tell the controller without undue delay. Confirm timing with counsel.
Should we rotate keys even if the vendor says we were not affected?
It is cheap insurance when the key grants broad access. Weigh effort against the key's reach.
Sources
Last reviewed: 19 October 2026.
