How Zwall holds authority when something fails.
The Manager you host is the authority for policy, identity, and events. This page states how admission, state, and recovery are designed to behave — and what is already a current operator fact. It is not a public availability percentage.
What this page is
How the control plane you host is designed to treat admission, state, events, and recovery. Certification, when published, lives on Certification and Supported Platforms.
Authority should not fail open
Manager running/ready is designed to require listeners and configured TLS trust material. Blocking authority is designed not to fail open if PostgreSQL cannot load it. This is not a universal fail-closed certificate.
Durable identity
Agents present Manager-issued credentials. A named identity-preserving upgrade contract is published when accepted.
Event delivery
The intended contract is at-least-once delivery with durable producer retention and idempotent acceptance. This is not a lossless capture product.
Queue ownership
Event and update queues are bounded operator-visible stores on the Agent and Manager path.
Failure must not look like zero
Hosting status can report permission_blocked or source_not_present instead of inventing events.
Install, upgrade, rollback
Community is a source build. Enterprise is designed around verified signed-release admission. In-product updater campaigns are not the production upgrade path. A named rollback or restore-plus-forward-fix contract is published when accepted. This page is not an RPO/RTO.
What we do not claim
This is not a 99.9% SLA, nor a lossless event delivery guarantee, nor a universal fail-closed promise.
Editions
Reliability contracts that depend on signed-release admission are Enterprise. Community source operators still host PostgreSQL and TLS; Community is not “unreliable.” It is a different admission path.
Reliability in Docs
FAQ
Is this a 99.9% SLA?
No.
Is event delivery lossless?
No. Intended contract is at-least-once with idempotent acceptance, not yet a finished public guarantee.
Is rollback certified?
No.
Does fail-closed apply everywhere?
No. Fail-closed behavior is scoped to the subsystems described above, not a universal guarantee.
Is secret custody certified?
No.