Status
What we commit to, and what we will never commit to.
Service level objectives, the definitions they are measured against, and how an incident is communicated. There is no live feed on this page yet, and rather than draw a board that is green because nothing is wired to it, we have left the space empty and said what will fill it.
Current state
No live feed yet
A component board and a rolling history appear here when the first production deployment goes live. It will be generated from the same measurements the objectives below are enforced against, not maintained by hand.
Planned · with the first production deployment
Service level objectives
Five objectives, each with the definition it is measured against. A definition that can be read two ways is not an objective, so the definition is published with the number rather than kept in a contract annex.
| Objective | Target | Measured as |
|---|---|---|
| Signal capture latency | P99 ≤ 15 s | From the block carrying an enforcement action reaching finality on its source chain, to the alert leaving our system. Measured per chain, on our side, on every alert rather than a sample. |
| Screening latency | P99 < 100 ms | A lookup against the authoritative lists we hold ourselves, measured at the API boundary. Coverage of that layer is total and the call is not billed. |
| Deposit decision latency | P99 < 3 s | A complete verdict, including any external source consulted along the way. A timeout inside this budget resolves to HOLD. There is no branch in which it resolves to a credit. |
| API availability | 99.9% monthly | Eligible requests answered without a server error, per calendar month. Our own 5xx counts against us. The client SDK reads a 5xx as HOLD by default, so an outage here makes a customer stricter and never looser. |
| Webhook delivery | At least once, within 24h | Exponential backoff with a dead letter queue. At least once means duplicates are possible by design, so consumers have to be idempotent. Delivery is retried; it is not silently dropped. |
What is deliberately not an objective
- Lead time
- Advance visibility is a by-product of how an issuer chooses to be governed, and an issuer can remove it without notice. Committing to an interval would mean committing to something we do not control. We commit instead to delivering the moment there is something to deliver, and to marking where we are blind.
- Completeness of coverage
- Some mechanisms leave no readable trace before they take effect. Every response carries a coverage health field so that a quiet feed and a blind one are distinguishable at the point of use, which is worth more than a number on this page.
- Accuracy of a judgement
- We report what we observed and preserve the evidence for it. We do not grade our own conclusions, and we do not offer a score that would invite you to treat them as graded.
What will appear here
- Per-component state, generated from the measurements above rather than set by hand.
- A ninety-day history of each objective, including the months we missed.
- The incident log, with every write-up kept rather than rotated out.
- The date the SOC 2 observation window opens, once it opens. Until then the security page says plainly that we hold no certification.
Incident communication
Written before the first incident, because a policy written during one is a negotiation.
- What counts as an incident
- Any period in which an objective above is not met, and any period in which we cannot assure isolation between customers. The second kind is treated as the most severe class regardless of how few customers it touched.
- Who hears first
- Affected customers, directly, before anything is posted publicly. This page follows, and it is never the first they hear of it.
- Timing
- A first notice within 60 minutes of confirmation, an update at least every 60 minutes while the incident is open, and a written review within ten business days of closing it.
- Afterwards
- The review is published here with the cause and what changed. It is redacted only where naming a customer would identify them, and never to make the story shorter.