> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/packages/secure-registry/service-level-agreement.md).

# Service Level Agreement

This page describes the service level commitments StepSecurity makes for Secure Registry: the availability of the proxy endpoints, and how quickly a package version found to be malicious is blocked.

### Availability commitment

StepSecurity commits to a **99.9% Monthly Uptime Percentage** for the Secure Registry proxy endpoints across every supported ecosystem: npm, PyPI, Maven, NuGet, and Go.

In practice, 99.9% allows the following monthly downtime budget:

| Month length | Maximum downtime |
| ------------ | ---------------- |
| 28 days      | 40 minutes       |
| 30 days      | 43 minutes       |
| 31 days      | 44 minutes       |

### How uptime is measured

Monthly Uptime Percentage is measured across all requests to your Secure Registry endpoints in a calendar month:

```
Monthly Uptime % = 100% - ((downtime minutes in the month / total minutes in the month) * 100)
```

A minute counts as downtime when requests to your Secure Registry endpoints fail or return a 5xx response for reasons within StepSecurity's control.

### Exclusions

The following do not count against the Monthly Uptime Percentage:

* **Scheduled maintenance**, announced at least 24 hours in advance.
* **Outages at the upstream public registry** being proxied, such as `registry.npmjs.org`, `pypi.org`, `repo1.maven.org`, `api.nuget.org`, or `proxy.golang.org`. Secure Registry forwards allowed requests to these hosts on your behalf, and their availability is outside StepSecurity's control. See Upstream registries for the full mapping of endpoints to upstream hosts.
* **Customer-side misconfiguration**, including an incorrect registry URL, expired or rotated-out API keys, and egress rules that block `registry.stepsecurity.io`.
* **Force majeure.**

{% hint style="info" %}
Two of these exclusions are avoidable with configuration you control. Allow `registry.stepsecurity.io` in any egress allowlist on your CI runners and developer machines, and use the **Primary** and **Secondary** API keys to rotate credentials without downtime. Both are covered in the Setup Guide. 
{% endhint %}

### Why 99.9%

Secure Registry runs on a redundant, multi-availability-zone architecture designed for high availability. 99.9% is the commitment StepSecurity can back end to end today.

A higher-availability tier can be discussed for customers with stricter continuity requirements. Contact your StepSecurity representative.

### Malicious package blocking

For a package version subsequently found to be malicious, StepSecurity commits to blocking it in Secure Registry **within 1 hour of its release to the upstream registry**. StepSecurity makes best efforts to block it faster than the 1-hour commitment.

This commitment is enforced through the Compromised Packages control, which must be enabled for the ecosystem in your Policy tab. Once a version is flagged, any request for it is blocked and the evaluation is recorded in the Policy Evaluations log with a status of **Blocked**.

The Cooldown Period control complements this commitment. Cooldown keeps newly published versions out of your environment for a configurable window, which covers the interval before a malicious version has been identified by anyone. Compromised Packages then enforces against versions that have been confirmed malicious, whether or not they fall inside the cooldown window.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.stepsecurity.io/packages/secure-registry/service-level-agreement.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.