Status

The rule every failure is designed around

An image request always returns a valid image, never a 403, a 404 or a 500. The email it sits in was delivered and cannot be recalled, so a broken image icon in an inbox is permanent. When something upstream fails the render falls back: the template's own fallback image, then the workspace default, then a plain branded one.

Quota works the same way. Going over your plan never breaks an image; past 110 percent of your included opens, new renders carry a small corner watermark until you change plan.

What is checked

The API reports whether Postgres and Redis are healthy at /ready, and the image service answers its own health check. After every deploy, a request for an image that does not exist is checked by hand and has to come back as a real 600 by 200 PNG.

The database is dumped to object storage hourly, kept 30 days.

What is not in place yet

There is no public monitor page yet, and automated alerting is on the launch list rather than done. The monitor page will be linked here when it is published, with figures it measured rather than numbers written by hand.

How you hear about an incident

Anything that affected rendering gets a dated entry in the changelog. If your workspace was affected you also get an email. If something looks wrong now, write to support@emailtimer.app with the image URL and the time.