Trust

Single region

SeaOtter runs in Google Cloud us-central1 only: the control plane (API + database) and every managed Hermes agent share that region. There is no automated cross-region failover today.

A regional outage in us-central1 would take down the product and all tenant agents at once until the region recovers or operators complete a manual recovery path.

What backups cover

• Control plane database — Cloud SQL automated backups and point-in-time recovery in us-central1. The database is zonal; there is no cross-region replica yet.
• Your agent data — same-region PVC snapshots. Typical recovery point objectives: up to 6 hours (Starter/Pro) or up to 1 hour (Enterprise). In-region restore is usually minutes when the cluster is healthy — that is an operational expectation, not a published RTO SLA.

What we are not claiming

• Multi-region or active-active hosting
• Automated failover out of us-central1
• That Enterprise pricing includes a regional uptime or DR SLA

Enterprise means custom quotas, SSO, and support — not multi-region redundancy.

Near-term improvement

By 31 Oct 2026 we intend to add a Cloud SQL cross-region read replica (us-east1) that can be promoted, plus a tested manual runbook to stand up a second-region cluster and redirect DNS. Expected recovery time for that path is hours (roughly 4–24), not minutes — and it is not a customer SLA until we measure and productize it.