Security
Incident Response SLOs
Our commitments for acknowledging, resolving, and communicating service incidents. These SLOs apply to all FrootAI Cloud services from GA onward.
Sev-1 — Critical
Service down for >5% of users, OR confirmed data exposure / breach
Acknowledge
15 minutes
Resolve
4 hours
Post-mortem
Public post-mortem within 5 business days
Examples:
- •Cloud Engine returning 5xx for all tenants
- •Confirmed unauthorized access to tenant data
- •Complete authentication system failure
- •Stripe webhook processing all billing events incorrectly
Sev-2 — Major
Major degradation affecting significant user functionality
Acknowledge
1 hour
Resolve
24 hours
Post-mortem
Internal post-mortem within 7 business days
Examples:
- •Cloud Eval returning incorrect scores for specific suites
- •GitHub sync failing for all users
- •P99 latency exceeding 10s sustained for 30 minutes
- •One region completely down (other region serving traffic)
Sev-3 — Minor
Minor degradation or non-critical feature unavailability
Acknowledge
4 hours
Resolve
72 hours
Post-mortem
Internal ticket with root cause (no formal post-mortem)
Examples:
- •Studio dashboard loading slowly (>3s)
- •Cost estimator showing stale pricing data
- •Uptime badge SVG not rendering
- •Non-critical API endpoint returning 500 intermittently (<1% of requests)
Escalation Policy
On-Call Rotation
Platform: PagerDuty (or Opsgenie)
Rotation: Weekly, alternating between founder and Eng#1
Coverage: 24/7 for Sev-1; business hours (EU timezone) for Sev-2/3
Handoff: Monday 09:00 UTC; outgoing on-call briefs incoming on open issues
Incident Communication
Incident channel: #incident-YYYY-MM-DD auto-created in Slack/Discord
Status page: status.frootai.dev updated within 2 min of detection
Email notifications: Subscribers notified on status change
Post-mortem: Published using post-mortem template
Our commitments
- ✓ We acknowledge every Sev-1 within 15 minutes — day or night
- ✓ We publish honest post-mortems — including when it's our fault
- ✓ We never hide incidents behind vague status page language
- ✓ SLA credits are automatic — you don't have to ask for them
- ✓ Every incident improves the system — no repeat root causes