Service level agreement

1. The commitment

The percentage is the commitment. The durations are what it works out to over a month of average length (30.44 days) — a 28-day month allows proportionally less and a 31-day month proportionally more, and the calculation we actually apply is the percentage against the month in question.

The figures above are commitments, not measurements. We hold an internal availability target of 99.993% across all regions, which is what we build for; we do not yet publish a measured trailing-twelve-month number, and we will not print one until it comes out of monitoring rather than out of a press release. The status page is where it will appear, together with the incident history, including the incidents that cost us credits.

2. How we measure

An instance is unavailable when it fails to respond to ICMP echo and to a TCP handshake on any listening port, from at least two of three independent external vantage points, for 60 consecutive seconds or more.

The three vantage points are operated for us by third parties on networks that are not ours, in three different countries. We do this because a monitoring system inside your own network measures your network's opinion of itself.

3. Credit schedule

Credits are calculated per instance, per calendar month, as a percentage of that instance's monthly charge:

Credits are applied to your prepaid balance and can be spent on anything, including a different instance in a different region. They do not expire. They are not a refund to chain, and they are not exchangeable for cryptocurrency.

4. Credits are automatic

This is deliberate. Most SLAs are structured so the customer bears the burden of claiming, and most customers never do, which makes the commitment cheaper than it appears. We would rather the commitment cost what it says it costs.

If you believe an outage was missed, write to us with the timestamp. We will check our monitoring and, if the outage is corroborated by any independent source you can point at, we will apply the credit without arguing about whose probes were right.

5. Exclusions

Downtime is not counted where it results from:

• Scheduled maintenance, announced at least 72 hours in advance on the status feed. We schedule it in the region's local overnight window and we design each window to stay under 15 minutes.
• Your own actions — a misconfigured firewall, an OOM condition, a kernel panic caused by your own module, a failure to unlock a LUKS volume after reboot, or exhausting your transfer allowance.
• Suspension for non-payment or an AUP breach.
• An attack against your instance that exceeds the mitigation capacity of the region. Regional capacity is published on each location page.
• Force majeure — natural disaster, war, or state action including seizure under a court order. We do not treat a seizure as an SLA event, but we do refund affected customers in full. That is what we did the one time it happened; the account is in the transparency report.

Notably not excluded: upstream carrier failures, facility power events, our own hardware failures, and our own software mistakes. Those are ours and we pay for them, automatically, without you filing anything.

6. Network commitments

• Packet loss within our network will not exceed 0.1% averaged over any 15-minute period.
• Latency within our network between any two of our regions will not exceed the published figure by more than 20% averaged over any 15-minute period.
• DDoS mitigation engages within 10 seconds of detection and does not redirect your traffic through a third party. We scrub on our own edge.
• IP replacement. If an address assigned to you appears on a major blocklist through no action of yours, we replace it within 4 hours at no charge.

Breach of a network commitment attracts the same credit schedule as an availability breach, calculated on the affected period.