Eight pillars, year-over-year, in public.
Aggregate uptime, incident posture, security and supply-chain discipline, AI governance, open source, sustainability, privacy + trust desk, and the people behind the platform. Refreshed every January with FY-prior numbers attached.
FY2026: 99.994 % uptime · 0 critical CVEs open · 184 t CO2e · every commitment landed.
Eleven incidents over the year, zero Sev-1, all postmortems published within the 14-day window. AIBOM expanded to cover every AI surface ahead of EU AI Act enforcement. Aggregate carbon footprint down 12 % year-over-year. Trust desk handled 186 artefact requests at a 99.4 % one-business-day SLA.
Aggregate uptime across all twelve services — eight platform modules plus regional ingress and the developer portal. Numbers track FY2026 against FY2025 baselines.
- Aggregate uptime99.994 %+0.012 pp
- Mean time to recovery21 min−9 min
- P99 API latency · EU184 ms−23 %
- Postmortems published11+3
Severity-weighted incident count and resolution discipline. Every incident has a public postmortem within 14 calendar days; no exceptions in FY2026.
- Total incidents11−2
- Critical (Sev-1)0no change
- Major (Sev-2)2−1
- P95 resolution time1 h 14 min−18 %
Vulnerability discipline across every module SBOM. CVE response measured from disclosure to remediation; zero high or critical CVEs open at year-end.
- CVE response · P5038 hours−27 %
- Critical / high open · EOY0no change
- Sigstore-signed releases100 %+18 pp
- External pen-tests4+1
Public AIBOM coverage and EU AI Act readiness. Every AI surface tagged with risk-tier; high-risk surfaces carry mandatory HITL.
- AI surfaces in AIBOM8 / 8+8
- High-risk surfaces4no change
- HITL-bound surfaces6 / 8+2
- Red-team exercises4+4
Maintained, sponsored and upstream-contributed projects. Engineering OSS-time budget held at 10 % across the platform engineering organisation.
- Maintained projects5+1
- Sponsored maintainers3no change
- Upstream PRs accepted74+22
- OSS-time budget held10 %on plan
Carbon footprint per tenant per year, region-aware grid intensity. CSRD-aligned scope-3 disclosure shipped to tenants via the audit envelope.
- Aggregate footprint184 t CO2e−12 %
- Per-tenant per-year0.62 t CO2e−18 %
- Renewable-mix coverage94 %+8 pp
- Sovereign-region intensity184 g/kWh−4 %
Trust artefact requests handled inside one business day. DPA countersignatures, subprocessor change notifications, regulator hand-offs.
- Trust requests handled186+44 %
- P95 SLA · 1-business-day99.4 %+1.2 pp
- Subprocessor changes · 30d notice6+2
- Regulator hand-offs8+3
Workforce, partner and programme metrics — the human side of the platform. Engineering headcount grew alongside customer programmes; partner network expanded across MENA + Africa.
- Active customer programmes34+11
- Listed partners12+4
- Engineering headcount142+38
- Workforce · jurisdictions14 countries+3
Annual numbers anchor every other trust artefact.
The transparency report is one read across the trust posture. The four pathways below take a procurement or security team from this report into deeper engagement.
- ST.00
Live status page
Per-service 90-day uptime, incident log, scheduled maintenance — the live counterpart to the annual aggregate.
ST.00 · 12 services - TC.00
Trust artefacts
SOC 2, ISO 27001, DPA, subprocessors — the artefacts the report numbers cite.
TC.00 · 8 artefacts - AG.00
AI governance
AIBOM, model cards, EU AI Act risk-tier — the underlying registry the AI numbers come from.
AG.00 · 8 surfaces - CB.00
Open scoping
Five-step intake routes a transparency-led discussion under CT.01 platform architecture session.
CT.01 · CB.00