Platform incident contacts
Draft: pending legal review.
If an account on a platform you use may be compromised, start with the platform\u2019s own pages below. Export logs early: platforms keep them for limited periods that depend on your plan and can change, so check the current documentation.
28 of 28
Amazon Web Services (AWS)
cloudSecurity page: abuse reports go to the AWS abuse form or trustandsafety@support.aws.com; vulnerabilities via HackerOne or aws-security@amazon.com. It says it has no specific procedure for reporting a compromised customer account; the re:Post article (title 'Resolve issues with unauthorized activity in AWS accounts') covers steps and responding in the AWS Support Center.
Some details couldn't be verified. Confirm on the official page.
Atlassian (Jira, Confluence, Bitbucket cloud)
collaborationCustomers are told to submit a ticket to Atlassian support. Audit log export: up to 10,000 activities from the past '180 days'; available on 'Any plan'; requires Organization admin, Site admin, or Unit admin role.
Some details couldn't be verified. Confirm on the official page.
Box
collaborationUsing Reports: 'these reports can go back as far as 7 years, or as long as you have an account tariff with reporting access'; 'You must be an organization administrator to run a report.' Trust Center names no channel for reporting an incident on your own account; it lists a vulnerability link and the Tech Support request form.
Some details couldn't be verified. Confirm on the official page.
Cloudflare
domains/hostingSupport doc lists account compromise as an example of a P1 (Urgent) case; Enterprise customers can call an emergency phone line but the number is not printed. Audit logs: 'retained for 18 months'; export via dashboard CSV or API.
Some details couldn't be verified. Confirm on the official page.
DocuSign
collaborationPage now points to the Docusign Safety Center (docusign.com/safety). Report impersonation email to verify@docusign.com; use Report Abuse for suspicious envelopes; Report Abuse webform for suspected fraud.
Some details couldn't be verified. Confirm on the official page.
Dropbox
collaborationHacked-account article covers version history checks, Rewind, password reset, 2-step verification and notes that a team admin may have used 'Sign in as user'. Activity: 'Usage data is available, beginning January 2017 or when your team began using Dropbox'; actions appear within 24 hours at most; CSV report export.
Some details couldn't be verified. Confirm on the official page.
GitHub
developer- Report a security incident
- Export audit or sign-in logs
- Personal security log
- Emergency credential revocation
Support handles security matters in writing through tickets and 'cannot fulfill requests to preserve logs or audit data'. Org audit log: 'contains data for the last 180 days'; personal security log: 'last 90 days'. Audit log streaming only captures activity from when enabled.
Some details couldn't be verified. Confirm on the official page.
GitLab
developerDisclosure page covers vulnerabilities in GitLab via HackerOne and says email to security@gitlab.com is 'no longer a supported disclosure method'. Audit events doc: 'Audit events are retained indefinitely'; group and project audit events are listed for Premium and Ultimate.
Some details couldn't be verified. Confirm on the official page.
GoDaddy
domains/hosting- Report a security incident
- Recover a compromised account
- Export audit or sign-in logs
- Regain access to a domain or account
- Contact Us form
Lock-down article: change passwords, remove delegates, delete unfamiliar API keys, sign out everywhere. Activity page shows 'Activity (last 90 days)'. Locked-out owners use Account Recovery, which requires government photo ID.
Some details couldn't be verified. Confirm on the official page.
Google Cloud
cloud- Report a security incident
- Recover a compromised account
- Export audit or sign-in logs
- Incident Response Assistance (Mandiant)
- Google Cloud Customer Care
- Cloud audit logs overview
Phone: +1 (844) 613-7588
Abuse page says to secure affected services and report abuse to Google Cloud Customer Care. Logging page lists the _Required bucket at '400 days' (not configurable) and _Default at '30 days'. Phone is the Mandiant incident response line printed on cloud.google.com/security/report-incident, which says its form is for corporate security incidents only.
Some details couldn't be verified. Confirm on the official page.
Google Workspace
identity/emailAdmin checklist: suspend user, review logs, reset password, revoke OAuth tokens, remove app passwords. Data retention page lists user (login) log events and admin log events as '6 months'.
Some details couldn't be verified. Confirm on the official page.
HubSpot
commerce/paymentsAudit logs need Super Admin: login history 'within the last 30 days'; security activity last 30 days with a separate export covering the last year. Security page routes vulnerabilities to Bugcrowd and lists no incident email or phone line.
Some details couldn't be verified. Confirm on the official page.
Mailchimp
commerce/payments'About Compromised Mailchimp Accounts': email Mailchimp from a secure address via the contact form; they 'turn off login and send capabilities' until you reset credentials, then delete and recreate API keys.
Some details couldn't be verified. Confirm on the official page.
Meta (Facebook Pages / Business accounts)
otherHacked Page recovery: submit the Page recovery form (log in first, or use facebook.com/hacked on a device you've used before); Meta can only act if it confirms the Page was compromised.
Some details couldn't be verified. Confirm on the official page.
Microsoft 365 / Entra ID (Azure AD)
identity/emailMicrosoft's guide says to disable the account (or reset the password), revoke sessions, and review MFA devices, app consents, roles, and forwarding. Audit (Standard) logs generated on or after Oct 17, 2023 follow a 180-day default; Entra audit and sign-in logs are 'Seven days' on Free and '30 days' on P1/P2.
Some details couldn't be verified. Confirm on the official page.
Microsoft Azure
cloudActivity log doc: 'Azure retains activity log events for 90 days and then deletes them.' Can be exported via diagnostic settings or CSV download.
Some details couldn't be verified. Confirm on the official page.
Namecheap
domains/hostingAbuse by others: abuse@namecheap.com (registered domains) or abuse@namecheaphosting.com (hosted). Compromise article: change password, enable 2FA, contact Support; account and domains may be temporarily locked during an investigation.
Some details couldn't be verified. Confirm on the official page.
Okta
identity/emailTrust site links 'Report a Vulnerability' and a Primary Security Contact setting used to alert customers of threats. Suspicious Activity Reporting doc: reports appear in System Log as user.account.report_suspicious_activity_by_enduser.
Some details couldn't be verified. Confirm on the official page.
PayPal
commerce/paymentsPersonal and Business accounts: report unauthorized transactions in the Resolution Center. Phone numbers on the page are product-specific (PayPal Credit, Cashback Mastercard, Business Debit Mastercard), so none is given as general support.
Some details couldn't be verified. Confirm on the official page.
QuickBooks / Intuit
commerce/paymentsHelp article says to forward phishing to security@intuit.com and report through the Intuit Online Security Center (security.intuit.com/contact-us). Phone numbers on the page are sales lines only.
Some details couldn't be verified. Confirm on the official page.
Salesforce
commerce/paymentsContact Salesforce Security page offers a Report Concern form for security or data confidentiality issues. Page lists no email or phone.
Some details couldn't be verified. Confirm on the official page.
Shopify
commerce/payments- Report a security incident
- Recover a compromised account
- Export audit or sign-in logs
- Shopify HackerOne
Account security article: 'contact Shopify Support immediately' if hacked. Security response page: vulnerabilities via HackerOne, other concerns via support request. Store activity log keeps entries for 18 months and cannot be exported.
Some details couldn't be verified. Confirm on the official page.
Slack
collaborationAudit logs are Enterprise-only: 'As of April 30, 2026, audit logs are retained for a maximum of two years for all Enterprise customers.' Workspace access logs are available on paid plans and the article states no retention period.
Some details couldn't be verified. Confirm on the official page.
Square
commerce/paymentsPhone: 1 (855) 700-6000
Article: contact Square immediately about unauthorized transactions or account changes; 'Only account owners and authorized representatives can contact Square about their account.' Review of account changes can take up to 48 hours.
Some details couldn't be verified. Confirm on the official page.
Stripe
commerce/paymentsSecurity page: security history logs of sensitive activity can be exported; vulnerabilities via HackerOne; 'Send support requests from the Dashboard after you log in' so Stripe can authenticate you. Recovery article: change email and password, turn on two-step verification.
Some details couldn't be verified. Confirm on the official page.
Twilio
otherFraud & Abuse Response Guide directs you to Twilio Support at help.twilio.com and says not to wait for Support to start containment. Monitor Events: 13 months for Administration, Security or Enterprise Edition; 30 days for free-version customers.
Some details couldn't be verified. Confirm on the official page.
WordPress.com
domains/hostingHack guide points to the activity log, Jetpack Scan, and contacting WordPress.com support. Covers only sites hosted by WordPress.com.
Some details couldn't be verified. Confirm on the official page.
Zoom
collaboration'Reporting a compromised account': submit Zoom's Trust & Safety form and choose 'Report Account Takeover'. Admin Activity Logs live under Reports > User activity reports.
Some details couldn't be verified. Confirm on the official page.
We have no affiliation or commercial relationship with any platform listed here. A listing is not an endorsement or a ranking. Contact details come from each organization's own website (checked 2026-11-03) and may change. We list a phone number or email only when we read it on an official page. Spot an error? Tell us. General information only, not legal advice: see the disclaimer.
More resources: all directories · Who to report to · Choosing an incident-response firm · For affected individuals