Operations
Service Levels (SLO / SLA)
Status: Living document · Owner: Studio + Engineering · Last reviewed: 2026-07-07
This document defines the service-level objectives we operate to and the service-level agreement we offer for licensing/business enquiries. Targets are steady-state and assume upstream providers (Vercel, Neon, Microsoft Graph, Instagram Graph) are within their own SLAs.
1. Service tiers
| Tier | Scope | Priority |
|---|---|---|
| Public gallery | Visitor-facing pages | Highest — must stay up and fast |
| Studio console | Operator back office | High |
| Ingestion & publishing | OneDrive sync, AI, Instagram | Best-effort, self-healing |
2. Availability objectives (SLO)
| Surface | Monthly uptime target | Notes |
|---|---|---|
| Public gallery | 99.9% | Served from Vercel's edge/CDN |
| Studio console | 99.5% | Auth-gated; depends on Entra ID |
| API layer | 99.5% | Excludes upstream provider outages |
3. Performance objectives
| Metric | Target |
|---|---|
| Gallery LCP (p75, mobile) | ≤ 2.5s |
| API latency (p95, excl. model calls) | ≤ 500ms |
| Interaction to Next Paint (p75) | ≤ 200ms |
4. Data & durability
- Source of truth for photos: the photographer's OneDrive / Google Drive (provider-managed durability). Full-res originals live there permanently; we keep only downscaled renditions (see ADR-009).
- Rendition durability: private Vercel Blob store; renditions are regenerable from the provider original if ever lost.
- Studio state: Neon Postgres, single JSONB row with a monotonic version.
- Secrets: OneDrive + Google refresh tokens encrypted at rest (AES-GCM).
- RPO (recovery point): ≤ 24h via Neon point-in-time restore.
- RTO (recovery time): ≤ 4h to restore service from a platform outage.
5. Reliability guarantees
- Concurrency safety: state writes are serialized (advisory lock + optimistic version check) — no lost updates.
- Graceful degradation: AI agents fall back to a deterministic mock; the ingestion pipeline never hard-fails on a model outage.
- No duplicate posts: Instagram publish is non-idempotent and never retried.
- Self-healing ingestion: a maintenance cron renews tokens and the OneDrive subscription before expiry.
6. Security commitments
- TLS everywhere (auto-provisioned, auto-renewed at the edge).
- MFA enforced by Microsoft Entra ID for operator access.
- Every API request: session check, per-IP rate limit, input validation, and a leak-proof error envelope.
- Access restricted to an email allowlist.
7. Support & response (SLA)
For licensing and business enquiries via niksacphotos@gmail.com:
| Severity | Definition | Response target |
|---|---|---|
| S1 | Public gallery down | 4 business hours |
| S2 | Studio or publishing impaired | 1 business day |
| S3 | General enquiry / licensing | 3 business days |
8. Exclusions
Objectives do not cover: upstream provider outages (Vercel, Neon, Microsoft, Instagram), scheduled maintenance announced in advance, or force-majeure events.
9. Production readiness checklist
- Neon pooled connection string in production
-
CRON_SECRET,STUDIO_SECRET,BETTER_AUTH_SECRETset in Production env - OneDrive webhook URL points at the production domain
- Rate limiting backed by Upstash Redis (shared across instances)
- Vercel Cron schedule configured for
/api/cron/maintenance