App incident severity levels

At Atlassian, we define an incident as an event that disrupts or reduces the quality of a service and requires an emergency response. We consider an app incident to be any instance where there is an existing or impending negative impact on our Marketplace app and integration partners.

Our response to incidents centers around our values. We aim to handle incidents in a way that aligns with the interests of our developers, partners, and customers. We strive to build a process that is consistent, repeatable, and efficient.

To increase transparency, we’re sharing our approach to defining severity levels of incidents related to apps. This is a key part of our journey to improve incident management between Atlassian and our developers and partners.

For a general introduction to Atlassian's approach to incident management and severity levels, see Incident Management and Understanding incident severity levels.

Reporting an incident

To report an incident, use these channels:

• To report incidents related to product APIs, security, or Atlassian Marketplace, visit Developer and Marketplace support. (For guidance on reporting critical incidents, see How to submit a critical incident.)

• Partners with at least one paid-via-Atlassian app can also report incidents in our Developer Community portal, in a dedicated restricted topic.

How we determine app incident severity

Severity definitions help us identify an adequate response to an incident. We’ve created an internal framework that helps us determine the severity of incidents based on the type of information available during the event.

Our primary point of reference is the number of end-users or apps affected by the event. When those numbers aren’t available, we use capability-based definitions.

Our incident framework includes these severity levels: SEV 1 - CRITICAL, SEV 2 - MAJOR, and SEV 3 - MINOR.

Determining severity based on the number of affected end-users or apps

When we know the number of end-users or apps affected by an incident, such as an API outage, we use that data to determine severity.

Determining severity based on affected capabilities

When we can’t assess the severity of an incident based on the number of affected end-users or apps, we use a capability-based framework.

Each capability in our development ecosystem and the Atlassian Marketplace belongs to one of three tiers — C1, C2, or C3. The tiers rank capabilities by their relative criticality, where C1 is the most critical tier and C3 is the least. For example, app deployment is a C1 capability while app logging is C3. (For a full list of capabilities and their associated tiers, see the Ecosystem and Marketplace capabilities section.)

The capability framework also distinguishes two types of incidents:

• An outage — for example, when a Forge app deployment doesn’t work.
• Degradation of a capability — for example, when an app slows down.

We use the following tables to determine severity based on the type of incident, the tier of the affected capability, and the incident's duration.

How we escalate incidents based on partner reports

When it comes to incidents, we want to be as responsive as possible. We escalate incidents according to the number of reports gathered from partners through service desks and Community posts.

Incidents are escalated according to this scale:

How we respond to incidents

The following details are provided for informational purposes so that Marketplace Partners and the developer community have more insight into how we respond to incidents.

Atlassian aims for the following, when possible:

• Major incidents (Sev 1 and Sev 2): Incident response teams start an investigation within 15 minutes of being paged and publish an initial status update within 1 hour of the incident start time. We define the incident start time as the point when the incident started impacting customers or partners. Atlassian strives to resolve Major incidents as quickly as possible.

• Minor incidents (Sev 3): Teams treat these incidents as high priority during local business hours and within existing release schedules.

For status on incidents that affect APIs, the Marketplace, and developers in general, visit developer.status.atlassian.com. For more detail on critical incidents, visit the public critical incident tickets page.

To drive continuous improvements in our processes, Atlassian actively monitors and analyzes a variety of metrics related to incidents.

Ecosystem and Marketplace capabilities

Ecosystem capabilities

Marketplace capabilities