Why Firecracker microVMs instead of Docker?

Each scan runs in a dedicated Firecracker microVM — the same isolation technology AWS Lambda uses. Unlike Docker containers, microVMs provide hardware-level isolation, preventing any cross-scan data leakage. Boot time is ~125ms, so there's no performance penalty.

Why a queue-based architecture?

Scans are CPU and network intensive. A Redis-backed queue (BullMQ) ensures fair scheduling, automatic retries on failure, and the ability to scale scan workers horizontally without touching the API layer. It also enables priority lanes for paid tiers.

Why Claude API for report generation?

Raw vulnerability data from tools like Nuclei and OWASP ZAP is technical noise for SMB decision-makers. Claude API reasons about findings in context — correlating vulnerabilities, mapping to DPDP sections, and generating plain-language remediation that a non-technical founder can act on.

How is scan data retained and secured?

Scan artifacts are encrypted at rest (AES-256) and purged after 90 days by default. Reports are stored in the customer's account with end-to-end encryption. We never share scan data with third parties. SOC 2 Type II certification is on our 2026 roadmap.

Commitments

Service Level Agreement

Our uptime, delivery, and response commitments to paying customers.

Platform Uptime

We target 99.5% monthly uptime for the Bachao.AI dashboard and API.

Uptime is measured as: (total minutes - downtime minutes) / total minutes

Scheduled maintenance windows are excluded from uptime calculations. Customers are notified at least 48 hours in advance of any scheduled maintenance via email and dashboard notification.

Scan Delivery SLA

Scan Type	Delivery SLA
VAPT Basic (public)	60 minutes
VAPT Full (authenticated)	90 minutes
Cloud Security Audit	120 minutes
API Security Scan	60 minutes
DPDP Compliance Report	30 minutes
ASM Discovery	24 hours (first scan)

Delivery SLA is measured from the time scan execution begins. Queue wait time during peak hours is excluded.

Support Response Times

Plan	Email Response	Priority Support
Free / Basic	24 hours	N/A
Starter	12 hours	N/A
Growth	4 hours	WhatsApp
Enterprise	1 hour	Dedicated Slack

Incident Response SLA

For customers with an active Incident Response retainer.

Tier	Response Time	Availability
On-Demand	24 hours	Business hours
Retainer	4 hours	24/7
Premium	2 hours	24/7
Enterprise	1 hour	24/7

RASP Agent SLA

Telemetry processing

Within 60 seconds

Rule sync

Next heartbeat (60s interval)

Event ingestion

99.9% acceptance rate

SLA Credits

If monthly platform uptime drops below 99.5%, paying customers receive service credits applied to their next billing cycle.

Monthly Uptime	Service Credit
99.0 -- 99.4%	5% credit
95.0 -- 98.9%	10% credit
Below 95.0%	25% credit

Credits are capped at 25% of the monthly fee for the affected service. Credits do not apply to one-time scan purchases.

Exclusions

The following are excluded from SLA calculations and credit eligibility:

Scheduled maintenance (notified 48 hours in advance)
Force majeure events (natural disasters, government actions, war)
Issues caused by customer actions (misconfiguration, credential revocation)
Third-party API outages (Anthropic, Cashfree, cloud providers)
Beta features and free-tier products
DNS propagation delays outside our control

How to Report an SLA Issue

Email sla@bachao.ai with the following:

Your account email and affected service
Date and time of the incident
Description of the issue and impact
Any relevant screenshots or error messages

Credit requests must be filed within 30 days of the incident. We will respond to SLA inquiries within 2 business days.

This SLA is effective as of March 2026 and applies to all paid Bachao.AI subscriptions and retainers. We may update this SLA with 30 days' notice.

Platform Uptime

We target 99.5% monthly uptime for the Bachao.AI dashboard and API.

Uptime is measured as: (total minutes - downtime minutes) / total minutes

Scheduled maintenance windows are excluded from uptime calculations. Customers are notified at least 48 hours in advance of any scheduled maintenance via email and dashboard notification.

Scan Delivery SLA

Scan Type	Delivery SLA
VAPT Basic (public)	60 minutes
VAPT Full (authenticated)	90 minutes
Cloud Security Audit	120 minutes
API Security Scan	60 minutes
DPDP Compliance Report	30 minutes
ASM Discovery	24 hours (first scan)

Delivery SLA is measured from the time scan execution begins. Queue wait time during peak hours is excluded.

Plan

Email Response

Priority Support

Free / Basic

24 hours

N/A

Starter

12 hours

N/A

Growth

4 hours

Enterprise

1 hour

Dedicated Slack

Tier

Response Time

Availability

On-Demand

24 hours

Business hours

Retainer

4 hours

24/7

Premium

2 hours

24/7

Enterprise

1 hour

24/7

SLA Credits

If monthly platform uptime drops below 99.5%, paying customers receive service credits applied to their next billing cycle.

Monthly Uptime	Service Credit
99.0 -- 99.4%	5% credit
95.0 -- 98.9%	10% credit
Below 95.0%	25% credit

Credits are capped at 25% of the monthly fee for the affected service. Credits do not apply to one-time scan purchases.

Exclusions

The following are excluded from SLA calculations and credit eligibility:

Scheduled maintenance (notified 48 hours in advance)

Force majeure events (natural disasters, government actions, war)

Issues caused by customer actions (misconfiguration, credential revocation)

Third-party API outages (Anthropic, Cashfree, cloud providers)

Beta features and free-tier products

DNS propagation delays outside our control

How to Report an SLA Issue

Email sla@bachao.ai with the following:

Your account email and affected service
Date and time of the incident
Description of the issue and impact
Any relevant screenshots or error messages

Credit requests must be filed within 30 days of the incident. We will respond to SLA inquiries within 2 business days.