# SLAs, SLOs & support

What's a target vs. a contractual guarantee for the Pro cloud API, how incidents are handled, and which support channel applies at each tier.

Source: https://www.afterpack.dev/docs/sla

An **SLO** is a target AfterPack designs and operates toward, without a financial guarantee. An **SLA** is a contractual commitment, typically with a financial remedy if missed.

## Mode 2: the Pro cloud API

[Indie, Team, and Studio](https://www.afterpack.dev/docs/tiers) builds that carry a [Pro key](https://www.afterpack.dev/docs/dashboard/api-keys) call [`api.afterpack.dev`](https://www.afterpack.dev/docs/cloud-api) in [Mode 2](https://www.afterpack.dev/docs/deployment-modes), using the [`key`](https://www.afterpack.dev/docs/config#key) or [`AFTERPACK_key`](https://www.afterpack.dev/docs/config#key) you configured. Its target:

| | |
|---|---|
| **SLO target** | 99.5% monthly availability |
| **Excludes** | See Exclusions below |
| **Infrastructure** | Cloudflare Workers, globally distributed, with each build bounded by an explicit CPU and wall-clock budget |
| **On unreachable** | The build [fails closed](https://www.afterpack.dev/docs/diagnostics#fail-closed-no-exceptions). |

## Exclusions

Three things sit outside the availability target above, and outside any liability for downtime:

- **The underlying providers.** AfterPack runs on infrastructure operated by third parties, Cloudflare in particular. An outage or degradation at one of them is excluded.
- **Scheduled maintenance**, announced at least 24 hours in advance.
- **Your own network or environment**, including a firewall, proxy, or DNS resolver that cannot reach the API.

## Enterprise SLA

[Enterprise](https://www.afterpack.dev/docs/tiers) contracts commit to **99.9% annual availability with financial penalties**. Exact remedy terms are set per agreement. See [Enterprise: SLA and operations](https://www.afterpack.dev/docs/enterprise#sla-and-operations) for the incident-response and support figures an Enterprise contract starts from.

## Status page

There is no public status page. Email **support@afterpack.dev** if you think the cloud is down; a failing build names the [diagnostic code](https://www.afterpack.dev/docs/diagnostics) to quote.

## Incident response

A total Mode 2 outage gets a public, blameless post-mortem on the blog within 5 business days: timeline, root cause, customer impact, and corrective actions with owners and deadlines. Enterprise contracts carry named response times (see [Enterprise](https://www.afterpack.dev/docs/enterprise#sla-and-operations)).

During a degraded window (elevated error rates or timeouts on the obfuscate endpoint), Pro builds [fail closed](https://www.afterpack.dev/docs/diagnostics#fail-closed-no-exceptions). [Free (local) builds](https://www.afterpack.dev/docs/deployment-modes) never call the API, so they are unaffected.

## Support channels by tier

| Tier | Channel |
|---|---|
| Free | [Documentation](https://www.afterpack.dev/docs), [FAQ](https://www.afterpack.dev/docs/faq) and GitHub |
| [Extra MB](https://www.afterpack.dev/docs/tiers), Indie | Email: **support@afterpack.dev** |
| Team | Priority email support |
| Studio | Priority email plus a dedicated chat channel |
| Enterprise | Dedicated Slack Connect, plus a named account manager and engineering liaison; contractual incident response of 4 business hours (P1) / 1 business day (P2) |

On every tier, including Free: questions and proposals go to [GitHub Discussions](https://github.com/afterpack-dev/afterpack/discussions), bugs to [GitHub Issues](https://github.com/afterpack-dev/afterpack/issues).

**support@afterpack.dev** typically responds within one business day regardless of tier. For deployment scoping, a custom contract, or compliance questions, see [Enterprise: contact](https://www.afterpack.dev/docs/enterprise#contact) for what to include.

## Security disclosure

Found a security issue, including a way to defeat protection ahead of a public writeup? Email **security@afterpack.dev** instead of filing a public issue. That address also handles a [leaked Pro key](https://www.afterpack.dev/docs/dashboard/api-keys). Enterprise contracts get a patch within 24 hours of a confirmed disclosure, cloud and on-prem alike. Every other tier gets the fix on the normal release cadence, prioritized by severity.

## Engine changes and versioning

A public Protection Changelog, naming the category and direction of every security-relevant engine change, is not available.

There is no LTS engine. See [How AfterPack works: a new program every build](https://www.afterpack.dev/docs/concepts#a-new-program-every-build).

AfterPack is pre-1.0, and `@afterpack/core`, the framework packages and the engine are versioned together. Security fixes ship on the latest release, so upgrade to receive them.

## Next

- [Builds & CI](https://www.afterpack.dev/docs/builds): the cloud-down behavior this page's SLO backs, and how rotation changes each build's structure.
- [Enterprise](https://www.afterpack.dev/docs/enterprise): the SLA, and the two deployment shapes.
- [Diagnostics](https://www.afterpack.dev/docs/diagnostics#exit-codes): the exit contract, and what a failed Pro build actually returns.
- [Deployment modes](https://www.afterpack.dev/docs/deployment-modes): what Mode 2 is, and what runs locally instead.
- [Privacy & data handling](https://www.afterpack.dev/docs/privacy): what the cloud this page covers actually stores.
- [Plans & tiers](https://www.afterpack.dev/docs/tiers): which plan each support channel above attaches to.