Operations
SLOs
Service-level objectives and what to measure.
#Service-level objectives
Recommended alert thresholds. Wire these into whatever monitoring you use (Datadog, Grafana, Cloudflare Alerts, AWS CloudWatch, etc.). The app exposes the metrics; picking when to page is your call.
#User-facing SLOs
| Indicator | Target | Alert at |
|---|---|---|
/api/health returns 200 |
99.9% over 30d | Any 5xx lasting >2 min |
p95 API response time (/v1/*) |
<500ms | >1s for 5 min |
| Magic-link email arrives | <30s p95 | >60s p95 for 10 min |
| Webhook delivery success | >95% of attempts | <90% for 15 min |
#Deliverability SLOs
SES thresholds are non-negotiable: sustained breach = account suspension.
| Indicator | SES limit | Alert at | Surface |
|---|---|---|---|
| 24h bounce rate | 5% critical, 10% auto-pause | 2% | Dashboard alert + email to owner |
| 24h complaint rate | 0.1% | 0.05% | Dashboard alert + email to owner |
The in-app <DeliverabilityAlert> component fires on these thresholds via
the deliverability.computeAllProjects cron (hourly).
#Queue health
| Indicator | Target | Alert at |
|---|---|---|
| Email queue depth (status=queued) | <1000 | >5000 for 10 min |
| Email status=failed rate | <1% of sends/day | >5% for 1 hour |
| Webhook delivery attempts avg | <2 | >4 avg over 1 hour |
Pull from Convex Insights or expose a Prometheus endpoint.
#Security SLOs
| Indicator | Target | Alert at |
|---|---|---|
| SNS signature failures | 0/day | >10/day (possible forgery attempt) |
| API key auth failures | <1% of requests | >10% for 10 min |
| Rate-limit hits per project | Normal traffic baseline | 10x baseline for 10 min |
Query via the errorLogs, Convex logs, and activity log tables.
#Response playbook
#Bounce rate climbing
- Check Settings → Activity for recent bulk sends.
- Review the offending campaign's audience quality.
- Pause sending (owner-only button in Settings → General) while you investigate.
- Remove invalid addresses from the audience.
#Webhook deliveries failing
- Check Settings → Webhooks → Activity icon to see per-delivery history.
- Common causes: customer endpoint down, cert expired, signature verification broken on their end.
- They can manually retry individual deliveries from the same UI.
#SES account suspended
- AWS will email the account owner. Don't argue - fix the bounce rate.
- Pause all sending via Settings emergency stop.
- Clean the audience (remove hard bounces, old addresses).
- Request reinstatement through AWS Support with evidence of the fix.