TAIGA SERVICE DESCRIPTION

This document describes the Services, how the Platform behaves, the service levels and the support at this version. It is incorporated by the Order Form in the version published on the date of the Order Form, and a new version applies as clause 1.2 of the Master Service Terms provides. Where it describes how the Platform works today, that behaviour may change in a later version; the commitments in the Master Service Terms do not change with it.

Learn. For each new Product the Customer adds, the Discovery Pipeline produces its discovery documentation. Every repository the Customer connects, on GitHub.com or GitHub Enterprise, is scanned for vulnerabilities, security findings and policy compliance, and rescanned after the Customer records a remediation against a finding. Learn consumes no Aurora.

Deliver. The specification is reviewed before work starts. Automated checks run before release and their results are recorded. Each Build delivers the implementation package: code, infrastructure definitions, CI/CD configuration and the audit trail for that Build, with the human contributions recorded against it.

Operate. TaigaSense monitors Delivered Software for vulnerabilities and application health, deploys it and reports delivery performance metrics. Detection and proposal is a service Taiga runs; deciding to apply a fix stays with the Customer.

Hosting modes. In Customer-hosted mode the Customer's code stays in its own repositories, reached through the GitHub App it installs and within the scopes it grants, and built applications deploy into the Customer's own cloud account. In Taiga-hosted mode Taiga provides the repository and runs the runtime. Both run in the EU; in neither is Customer Content used to train a model. The mode is chosen per Product in the Platform.

The Account Cap is always on. The Platform shows the Billing Administrator consumption against the cap and warns as it approaches, with a forecast. At the cap the Account enters Action Required and work queues; nothing is charged beyond the step.

A step-up happens only with the Customer's acceptance: the Customer's administrator can accept one in advance, up to a ceiling set in the Platform, or when the pool runs out, and the Account moves only to the step accepted. A step-up is charged from the day it takes effect and the Account returns to the steps on the Order Form for the following month unless the Customer keeps the higher step. A step-down takes effect as clause 4.5 of the Master Service Terms provides.

Targets. Monthly availability of the Taiga control plane: 99.5% on Start and for a Learn-only Account; 99.7% on Scale, including stacked units; 99.9% on Portfolio. The target follows the Deliver + Operate step. What the commitment covers and excludes is in Schedule A of the Master Service Terms.

Measurement. Availability is (total minutes minus excluded minutes minus unavailable minutes) over (total minutes minus excluded minutes), per calendar month. Planned maintenance announced in advance and scheduled outside Finnish business hours is excluded; emergency security maintenance is excluded with notice as soon as practicable. Taiga provides the monthly figure on request.

Service credits. Below target but at or above 99.0%: 10% of that month's fee for the affected rail. Below 99.0% but at or above 95.0%: 25%. Below 95.0%: 50%.

Where the number comes from. The Platform runs in AWS eu-central-1 across more than one availability zone. A region-wide failure can exceed any target; the credit is the remedy. These targets are commitments about the future and not a claim about measured past performance.

Support is included on every step, 09:00–17:00 EET on Finnish business days: response within four business hours for a P1 (production down or unusable), one business day for a P2 (materially impaired), two business days for a P3 (other). Support is in English. Assistance beyond support is agreed in writing before the work.

Taiga scans its own code, dependencies, images and infrastructure continuously and remediates confirmed vulnerabilities on a severity-based schedule, critical and high first. The current control set is described at tai.ga/en/trust, and the assurance status — what is held and what is not — is stated in Schedule B of the Master Service Terms.