enterprise support
Support Policy
The written commitments behind every enterprise subscription, from severity classification to resolution targets and vulnerability remediation SLAs.
1 hour
Initial response on a production incident
4 hours
Target resolution on a production incident
72 hours
To remediate a critical vulnerability
1Scope of support
This policy applies to the whole of ControlPlane Enterprise for Flux CD: the hardened distribution and every enterprise addon covered by your subscription, running in a Supported Configuration. Security fixes and bug fixes are backported to the three most recent minor releases, and the list of Supported Configurations is published in the enterprise documentation.
2Raising a case
Cases are opened by Authorized Users who have been onboarded to the support system. Contact details for each channel are issued during onboarding and are not published here.
Support portal
The primary channel for raising and tracking Cases, and for access to the technical knowledge base. Credentials are issued to each Authorized User during onboarding.
Cases may also be filed by email to the support address issued at onboarding. Case tracking starts when ControlPlane sends a written acknowledgement.
Phone
Required to open a Severity 1 Case and start the emergency response workflow. The number is issued at onboarding and is answered at any hour, on any day.
3Severity levels
ControlPlane uses the following definitions to classify Cases.
A production system that is critical to the business is completely inoperable, work has stopped, and no workaround is available.
Core functionality in a production system is severely degraded and operations can continue only in a restricted fashion, with no workaround immediately available.
Partial loss of non-critical functionality, including defects and performance degradation affecting specific operations, with no known workaround.
No loss of service. Covers requests for technical information, feature requests, and minor defects for which an effective workaround exists.
The severity of a Case is agreed with the Authorized User when it is opened, and either party may change it if the business impact changes. A Severity 3 defect that develops into a production outage is raised to Severity 1, and a Severity 2 Case with a working workaround in place is lowered to Severity 3.
4Response and resolution targets
ControlPlane meets the targets below for 95% of Cases opened in any calendar month. Initial response and Resolution are defined in section 10.
| Severity | Coverage | Channel | Initial response | Target resolution |
|---|---|---|---|---|
| Severity 1a | 24 hours a day, 7 days a week | Phone | 1 hour | 4 hours |
| Severity 2b | Support Hours | Portal or phone | 4 Support Hours | 8 Support Hours |
| Severity 3 | Support Hours | Portal or phone | 1 Support Day | 2 Support Days |
| Severity 4 | Support Hours | Portal or phone | 2 Support Days | 5 Support Days |
- aSeverity 1 Cases must be opened by phone. Cover runs continuously until the incident is resolved or downgraded, including weekends and public holidays.
- bSeverity 2 Cases are not automatically covered outside Support Hours. Once a workaround is in place, a Severity 2 Case is reclassified as Severity 3.
5Vulnerability remediation
ControlPlane monitors the Flux controllers and their dependencies for vulnerabilities continuously. Findings are scored with CVSS, assessed for exploitability in the context of the distribution, and either patched or documented as not exploitable in a signed OpenVEX attestation. The security architecture page describes how the assessments and attestations are produced.
Two remediation frameworks are available. Your subscription agreement sets which one applies.
Standard remediation
The clock starts when ControlPlane identifies a vulnerability or receives a report of one.
- Critical, CVSS 9.0 to 10.0
- 72 hours
- High, Medium and Low, CVSS 0.1 to 8.9
- 5 Support Days
Upstream patch remediation
The clock starts when a Qualifying Patch for the vulnerability becomes publicly available.
- Critical, CVSS 9.0 to 10.0
- 7 calendar days
- High, Medium and Low, CVSS 0.1 to 8.9
- 14 calendar days
6Coverage and support hours
Support is staffed from North America, EMEA, and Asia-Pacific by ControlPlane support engineers working alongside CNCF Flux core maintainers employed by ControlPlane. Each customer is aligned to one region at the start of the subscription, which sets the Support Hours that apply to Severity 2, 3, and 4 Cases.
| Region | Coverage area | Support Hours |
|---|---|---|
| AMER | North America | 09:00 to 17:00 EST |
| EMEA | Europe, Middle East and Africa | 09:00 to 17:00 GMT or CET |
| APAC | Asia-Pacific | 09:00 to 17:00 AEST |
Severity 1 incidents are covered 24 hours a day, 7 days a week, in every region.
7Escalation
Three escalation tiers are available to every subscription, each with a named contact provided at onboarding. Every tier carries the authority to commit engineering effort, and the path ends at ControlPlane's executive team rather than at another queue.
- Level 1
Enterprise Account Manager
A response or resolution target is at risk, or engineering coordination needs adjusting.
- Level 2
Head of Customer Success
Resolution is not progressing, business impact is increasing, or the same issue keeps recurring.
- Level 3
Executive sponsor
Repeated or unresolved Severity 1 Cases, an unmitigated critical vulnerability, or a risk acceptance decision.
8Customer responsibilities
The targets in section 4 assume the following on the customer side.
Maintain Authorized Users
Designate at least one Authorized User for the duration of the subscription. Authorized Users need a working knowledge of GitOps practice and the Flux command line tooling in order to work alongside ControlPlane engineers.
Triage before escalating
Confirm that the problem sits in a supported component and that your own first-line and second-line diagnostics have been exhausted before opening a Case.
Provide diagnostic material
Supply the logs, manifests, versions, and system access required to reproduce the problem, and keep them current for as long as the Case is open.
9Exclusions
The following are not measured against the targets in this policy:
- Unsupported Configurations, including modified source code and architectural changes made without written endorsement from ControlPlane.
- Delays caused by the customer, such as missing access, missing environment information, or pending internal approvals.
- Community-only or end-of-life upstream releases that are no longer maintained by their respective projects.
- Consulting, enhancement discussions, and feature requests that fall outside the supported components.
10Definitions
- Authorized User
- An individual named by the customer and onboarded to the ControlPlane support system, permitted to open and progress Cases.
- Case
- A service request, problem report, question, or defect report submitted by an Authorized User through one of the channels in section 2.
- Initial response
- The first substantive reply from a ControlPlane engineer engaged with the Case. An automated ticket acknowledgement is not an initial response.
- Resolution
- A fix, a patched build, or a workaround accepted by the customer that returns the affected system to normal operation.
- Support Day
- Any day other than a Saturday, a Sunday, or a public holiday in the jurisdiction in which the services are delivered.
- Support Hours
- 09:00 to 17:00 on a Support Day, in the regional time zone assigned to the customer at the start of the subscription.
- Supported Configuration
- A distribution channel and version listed in the enterprise documentation, deployed as delivered from the ControlPlane registries.
- Qualifying Patch
- A publicly available upstream release that fully mitigates a given vulnerability, used as the start of the clock under upstream patch remediation.
ControlPlane may update this policy as the distribution and the support organisation evolve. Customers are notified of material changes through their account contact. Last updated July 2026.
Put these commitments under contract
Talk to ControlPlane about a subscription sized to your fleet, with the remediation framework that fits your regulatory obligations.