Service Level Agreement

This page describes the service level commitments StepSecurity makes for Secure Registry: the availability of the proxy endpoints, and how quickly a package version found to be malicious is blocked.

Availability commitment

StepSecurity commits to a 99.9% Monthly Uptime Percentage for the Secure Registry proxy endpoints across every supported ecosystem: npm, PyPI, Maven, NuGet, and Go.

In practice, 99.9% allows the following monthly downtime budget:

Month length	Maximum downtime
28 days	40 minutes
30 days	43 minutes
31 days	44 minutes

How uptime is measured

Monthly Uptime Percentage is measured across all requests to your Secure Registry endpoints in a calendar month:

Monthly Uptime % = 100% - ((downtime minutes in the month / total minutes in the month) * 100)

A minute counts as downtime when requests to your Secure Registry endpoints fail or return a 5xx response for reasons within StepSecurity's control.

Exclusions

The following do not count against the Monthly Uptime Percentage:

• Scheduled maintenance, announced at least 24 hours in advance.
• Outages at the upstream public registry being proxied, such as registry.npmjs.org, pypi.org, repo1.maven.org, api.nuget.org, or proxy.golang.org. Secure Registry forwards allowed requests to these hosts on your behalf, and their availability is outside StepSecurity's control. See Upstream registries for the full mapping of endpoints to upstream hosts.
• Customer-side misconfiguration, including an incorrect registry URL, expired or rotated-out API keys, and egress rules that block registry.stepsecurity.io.
• Force majeure.

Two of these exclusions are avoidable with configuration you control. Allow registry.stepsecurity.io in any egress allowlist on your CI runners and developer machines, and use the Primary and Secondary API keys to rotate credentials without downtime. Both are covered in the Setup Guide.

Why 99.9%

Secure Registry runs on a redundant, multi-availability-zone architecture designed for high availability. 99.9% is the commitment StepSecurity can back end to end today.

A higher-availability tier can be discussed for customers with stricter continuity requirements. Contact your StepSecurity representative.

Malicious package blocking

For a package version subsequently found to be malicious, StepSecurity commits to blocking it in Secure Registry within 1 hour of its release to the upstream registry. StepSecurity makes best efforts to block it faster than the 1-hour commitment.

This commitment is enforced through the Compromised Packages control, which must be enabled for the ecosystem in your Policy tab. Once a version is flagged, any request for it is blocked and the evaluation is recorded in the Policy Evaluations log with a status of Blocked.

The Cooldown Period control complements this commitment. Cooldown keeps newly published versions out of your environment for a configurable window, which covers the interval before a malicious version has been identified by anyone. Compromised Packages then enforces against versions that have been confirmed malicious, whether or not they fall inside the cooldown window.