Loading
Trust
Status and uptime as measured, the service levels each plan commits to and how the platform measures them, the data-processing agreement outline, every subprocessor, the security overview and how to report a vulnerability, and the legal versions in force. Nothing here is a claim the OpenSmartRoute platform cannot show you live.
Right now
From the status page: components, incidents and the monitor's own heartbeat, refreshed every 60 seconds.
Service levels
The commitments come from the live plan table, the same one the pricing page and the API publish. A workspace reads its own calendar month against them at GET /api/v1/sla and on its billing page - availability is the share of its metered requests the platform answered without a server error; support is the first response to the tickets it opened.
| Plan | Monthly availability | Support | First response | Standing |
|---|---|---|---|---|
| Free | No commitment | Community support | As capacity allows | Best effort |
| Pay as you go | No commitment | Community support | As capacity allows | Best effort |
| Pro | No commitment | E-mail support | within 2 days | Target, measured |
| Team | No commitment | Priority e-mail support | within 8 hours | Target, measured |
| Enterprise | 99.9% | Dedicated support with an SLA | within 4 hours | Commitment, with service credits in the agreement |
Measured, not promised. Availability counts every metered request of the workspace in the calendar month (UTC) and the share answered without a 5xx. Requests refused for quota, policy or an invalid key are not failures; a provider you connected yourself failing is reported as such on the trace and does not count against the platform.
Credits. On the plan sold through sales, service credits for a missed month follow the enterprise agreement; the month's figure at GET /api/v1/sla is the evidence. The other plans carry targets, not commitments, as the terms say.
Self-hosted. The same package runs in your cloud or on your own metal under Apache-2.0; availability is then yours to run, and the platform's status has no bearing on it.
Data processing
The outline of the agreement hosted customers sign; your own paper is accepted where you insist. Self-hosted editions involve no processing by us, so no agreement is needed unless you grant support access to logs - then a narrow support agreement covers it.
Subprocessors
Annex III of the agreement. A change is announced here and in the changelog thirty days before it takes effect.
| Subprocessor | Role | Location | Data |
|---|---|---|---|
| Microsoft Azure | Hosting: the web app, the API and the database (Container Apps) | Sweden Central (EU) | Every record the platform stores; request text only in memory while a decision is made or a request is forwarded |
| Microsoft (Microsoft 365 / Azure Communication Services) | Transactional e-mail | EU | Recipient address, subject and body of the messages the platform sends; a copy kept 30 days |
| Stripe | Payments, invoices, tax calculation | United States / EU | Billing name, address, tax id, card details (never seen by the platform), invoices |
| The model provider behind the chosen target | Executing a request, only when execution is asked for | As the target declares (region and data boundary are routing constraints) | The request text and the answer; your own provider under your own contract when you connected one |
| Google LLC (Google Analytics 4) | Aggregate statistics on the public pages, subject to consent | United States | Page views on the public site; never linked to an account or joined with usage |
Security
No certification is claimed that is not held: a SOC 2 Type I is targeted and, until it is issued, this page, the security review and an architecture call with your security team are the review. Everything below is verifiable without talking to us.
Legal
Every change is announced 30 days before it takes effect; the history is public and a signed-in person sees the version they accepted.
In force since Sep 6, 2026
In force since Sep 6, 2026
Terms, privacy notice, changelog and who runs it.
Then ask sales for the signed agreement and the security questionnaire pre-filled from the security review - or route a request and read the trace while you wait.
Free plan, no card. Fifteen thousand decisions a month with the full trace.
Ask for the signed template through sales; the privacy notice describes what is stored and for how long.
GET /api/v1/governance scores the controls the customer owns - keys, budgets, policy - and GET /api/v1/governance/report?format=markdown is the evidence pack an auditor asks for; the platform's own items (audit chain, guard, tracing) are reported separately as what the platform reports.