Maintenance & patching
How updates, patches, and routine maintenance are scheduled and communicated.
Routine patching #
Operating systems, runtimes, and dependencies are patched on a monthly cycle by default, with the schedule published in your runbook. Most patching is invisible: rolling updates behind the load balancer mean no user-facing downtime for the common case.
Security patches #
Critical vulnerabilities (actively exploited, or CVSS 9+ affecting exposed components) skip the cycle: we patch within 48 hours, with emergency change procedures and a note to you the same day. We would rather interrupt a Tuesday than explain a breach.
Maintenance windows #
Work that does require downtime is scheduled inside maintenance windows you approve — typically low-traffic hours in your timezone, announced at least five business days ahead with expected impact and rollback plan. Windows are excluded from SLA math only when announced and approved this way; surprise downtime always counts against us.
How you are notified #
| Event | Notice | Channel |
|---|---|---|
| Routine patching (no downtime) | Listed in monthly report | Report only — it is invisible by design |
| Maintenance window (downtime) | ≥5 business days ahead | Email + shared channel, with impact & rollback plan |
| Emergency security patch | Same day | Shared channel before, summary after |
| Anything that changes user-visible behavior | Before it ships | Demo or written note — never a surprise in production |
Maintained by the delivery team · updated quarterly