Change notice policy

How we tell you, and how far in advance

A vendor that touches your P&L should never surprise you. This is the standing change-notice policy: what triggers a notice, what minimum window we commit to, the channel, the approver, and the rollback path.

Channels

Portal, email, RSS, invoice line

Minimum notice (pricing)

90 days

Plus a 60-day exit window

Bundle rollback

≤ 60 s

One command, audited

Independence

Audited annually

Sample of notices reviewed by BDO

Notice table

Change	Min. notice	Channel	Approver	Rollback / remedy
Price increase	≥ 90 days	Account email + portal banner + invoice line	CFO sign-off, annual cap CPI+1%	Customer may exit penalty-free within 60 days
New sub-processor	≥ 30 days	/legal/subprocessors page + RSS + customer email	DPO + Security sign-off	Customer may object; we will not onboard the sub-processor for that tenant
Material policy bundle change	≥ 14 days (≥ 30 days if customer-affecting)	Portal banner + change-advisory page + email	CAB review, 2-of-2 maintainers	1-command rollback to previous bundle, ≤60s
Breaking API change	≥ 180 days	/docs banner + deprecation header + email	Eng director + DX lead	Old endpoint preserved for the notice window
Endpoint deprecation (non-breaking)	≥ 90 days	/docs note + sunset header	DX lead	Reactivation behind feature flag if needed
Region or residency change	≥ 60 days	Account email + DPA addendum	DPO + Customer success exec	Customer may decline; data stays in current region
Service level update (lowering)	≥ 90 days	/service-levels + email + portal banner	CTO + CFO sign-off	Customer may exit penalty-free within 60 days
Service level update (raising)	0 days (effective immediately)	/service-levels + portal banner	CTO sign-off	n/a (improvement)
Brand or legal entity change	≥ 60 days	Email + portal banner + invoice	Board minute	Customer retains all rights under MSA novation clause
Emergency security fix	0 days (post-hoc within 5 business days)	/security-bulletins + customer email	Security + on-call exec	Documented in incident report on /transparency

If we miss a notice

The change is rolled back to the previous state until the notice window is satisfied.
The miss is logged in /trust-ledger with the root cause and a remediation owner.
Affected customers receive a written explanation within five business days and, where material, a credit per the SLA table.