Service Level Agreement (SLA)

• Public verification + read API (/verify, /api/coa, /api/v1/public/*, /.well-known/*).
• Authenticated API (/api/v1) for orders, samples, COAs, and export.
• Webhook delivery for coa.released / coa.revoked / coa.amended / coa.superseded.

Axiom targets 99.9% monthly availability for the public verification + read API, measured as successful responses to a synthetic probe of /api/status, excluding scheduled maintenance and factors outside our control (upstream network, DNS, or the client's own systems).

Released certificates are immutable and independently verifiable offline against the published JWKS and signing spec — so authenticity verification does not depend on Axiom uptime even during an incident.

• Public COA reads are cacheable (short TTL + ETag) so relying parties and CDNs are not coupled live to the origin on every pageview.
• Revoked / superseded certificates are served no-store so a pulled certificate is never cached as valid.
• Webhook delivery is a durable outbox with retry/backoff (8 attempts), dead-lettering, and a reconciliation backstop — transient client downtime does not lose events.

Planned maintenance that may affect availability is announced in advance where practical and scheduled to minimize impact. Status is published at /api/status.

• Standard support via support@axiomanalyticslab.com during business hours.
• Security issues: legal@axiomanalyticslab.com — see the Security statement for triage targets.
• Integration/API questions: the /developers guide + OpenAPI at /api/v1/openapi.json.

Stable endpoints live under /api/v1. A deprecated API version is supported for at least 6 months after its successor is generally available, with notice in the changelog and the Deprecation/Sunset response headers.

Axiom Analytics Labs LLC · support@axiomanalyticslab.com