Service level agreements
Listed terms cover requests sent through this service adapter. They do not cover direct connections to the target service or replace the cloud provider’s own SLA. Each origin-to-target pair has its own terms or an explicit pending status. See the SLA tables, measurement rules, and scaling conditions.Cloud KMS to KMS Keys
Deployment availability. These targets describe this adapter design. Confirm that your deployment supports the listed operations; a numerical target does not establish runtime availability.
What Tensor9 covers. These service levels cover the adapter between the origin API and target API. They do not replace the target provider’s SLA.
How latency is counted. Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.
Which terms apply. Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.
What this adapter does
Foraws::1.0.0::kms, key-ring/key identity is maintained separately from the native key object. The profile admits bounded symmetric encrypt/decrypt but does not offer arbitrary version-addressed calls; rotation and protection-level differences remain documented. These targets describe this adapter design; confirm that your deployment supports the listed operations. A numerical target does not establish runtime availability.
How the latency targets were chosen
Bounded symmetric cryptographic calls: 1 ms monthly p99.cloudkms.projects.locations.keyRings.cryptoKeys.decrypt, cloudkms.projects.locations.keyRings.cryptoKeys.encrypt. Bounded encoding and target-key resolution; measured native cryptographic execution is separate, while adapter-owned key metadata remains included.
Key and version management: 20 ms monthly p99. cloudkms.projects.locations.keyRings.create, cloudkms.projects.locations.keyRings.cryptoKeys.create. Bounded configuration validation, durable adapter metadata and response encoding; native provisioning completion and propagation are separate.
Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.
What counts toward latency
For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter’s own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request’s adapter duration first, then the monthly p99. Do not subtract one service’s p99 from another’s. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.Availability and failures
The 99.9% request target measures correct adapter handling, not the percentage of application calls that return success. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures count even when the target is healthy. With 1,000,000 eligible calls in a month, a 99.9% target permits at most 1,000 adapter-attributable failures. Endpoint probes have their own denominator. Correctness defects remain actionable even when the monthly availability percentage is met.Scaling and target-service capacity
Bound crypto calls, metadata lookups, key-version churn and rotation bursts separately. Tensor9 scales request translation within the agreed limits, but native HSM/cryptographic quotas and key configuration remain target concerns. Key management traffic can contend with request-time identity resolution; it cannot be hidden by measuring only the native signing duration. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service’s capacity with Tensor9’s help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.Data and behavior guarantees
Never select a different key version or downgrade the requested protection/algorithm silently. Preserve authenticated-data and error semantics within the supported profile. Failed authorization must not become a successful cryptographic result. Secret/private-key material is not diagnostic evidence to share, and the target’s hardware/durability certification is not implied by a 1 or 3 ms adapter budget.Example and diagnosis
Encrypt a 1 KiB payload using the AWS KMS target, or sign a supported digest using the Key Vault target. These are different directed operation sets, not interchangeable guarantees. Retain key identifiers and algorithm names in redacted diagnostics; compare translation/lookup time with native cryptographic service timing. Usetensor9 explain and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider’s latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.
Cloud KMS to Key Vault
Deployment availability. These targets describe this adapter design. Confirm that your deployment supports the listed operations; a numerical target does not establish runtime availability.
What Tensor9 covers. These service levels cover the adapter between the origin API and target API. They do not replace the target provider’s SLA.
How latency is counted. Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.
Which terms apply. Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.
What this adapter does
Forazure::1.0.0::keyvault, key-ring/key identity is maintained separately from the native key object. The profile covers supported asymmetric key/signing behavior, not Cloud KMS symmetric encrypt/decrypt or MAC keys. Native Key Vault versions and soft-deletion/name reuse require target-specific handling. A public-key verification performed entirely by a client has no adapter request latency. These targets describe this adapter design; confirm that your deployment supports the listed operations. A numerical target does not establish runtime availability.
How the latency targets were chosen
Bounded asymmetric signing: 3 ms monthly p99.cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.asymmetricSign. Map key version and digest parameters, validate algorithm compatibility and encode the native signature.
Key and version management: 20 ms monthly p99. cloudkms.projects.locations.keyRings.create, cloudkms.projects.locations.keyRings.cryptoKeys.create, cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.create, cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.destroy, cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.restore. Bounded configuration validation, durable adapter metadata and response encoding; native provisioning completion and propagation are separate.
Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.
What counts toward latency
For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter’s own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it. For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request’s adapter duration first, then the monthly p99. Do not subtract one service’s p99 from another’s. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.Availability and failures
The 99.9% request target measures correct adapter handling, not the percentage of application calls that return success. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures count even when the target is healthy. With 1,000,000 eligible calls in a month, a 99.9% target permits at most 1,000 adapter-attributable failures. Endpoint probes have their own denominator. Correctness defects remain actionable even when the monthly availability percentage is met.Scaling and target-service capacity
Bound crypto calls, metadata lookups, key-version churn and rotation bursts separately. Tensor9 scales request translation within the agreed limits, but native HSM/cryptographic quotas and key configuration remain target concerns. Key management traffic can contend with request-time identity resolution; it cannot be hidden by measuring only the native signing duration. Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service’s capacity with Tensor9’s help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.Data and behavior guarantees
Never select a different key version or downgrade the requested protection/algorithm silently. Preserve authenticated-data and error semantics within the supported profile. Failed authorization must not become a successful cryptographic result. Secret/private-key material is not diagnostic evidence to share, and the target’s hardware/durability certification is not implied by a 1 or 3 ms adapter budget.Example and diagnosis
Encrypt a 1 KiB payload using the AWS KMS target, or sign a supported digest using the Key Vault target. These are different directed operation sets, not interchangeable guarantees. Retain key identifiers and algorithm names in redacted diagnostics; compare translation/lookup time with native cryptographic service timing. Usetensor9 explain and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider’s latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.