Infrastructure Overview
Compute auto-scaling: Vercel serverless functions scale automatically with traffic. There is no warm-up period on primary API routes. Cold starts do not apply to Edge-deployed routes.
Database scaling: PgBouncer pools connections to the PostgreSQL instance, preventing connection exhaustion under concurrent load. The database is the primary scaling constraint — see rate limits below for the limits that protect it.
API Rate Limits
Rate limits are applied per API key, on a rolling 60-second window. When a limit is exceeded, the API returns429 Too Many Requests with a Retry-After header indicating how many seconds to wait before retrying.
Burst behavior: Short bursts above the limit may be absorbed by token-bucket smoothing. Sustained traffic above the limit will consistently return
429.
Shared limits: Rate limits apply to the API key, not to individual learners. If your integration routes all learners through a single API key (standard setup), design your backend to aggregate and respect these limits.
Monthly Usage Quotas
Usage quotas reset on the 1st of each calendar month at 00:00 UTC.Submission Quota
A submission is counted each time a learner completes and submits a full assessment, through any delivery path: the REST API (POST /assessments/{id}/submit), the embedded SDK player, or an Edpire-hosted share link. Partial saves, draft states, and preview calls are not counted.
API Call Quota
An API call is counted for each request to the/check endpoint or any read endpoint (GET requests). Write endpoints other than /submit (e.g., webhook registration) are not counted against this quota.
Overage Billing
When a quota is exceeded, calls are not blocked — they continue to succeed and are billed as overage at the end of the billing period.
Overage is billed in whole blocks. Partial blocks are rounded up. Edpire sends an email notification when usage reaches 80% and 100% of the included quota.
API Response Times
The following commitments apply to production API endpoints under normal load:
Excluded from response time guarantees:
- Endpoints that trigger AI evaluation (grading latency depends on third-party model response times)
- File upload endpoints (latency scales with file size)
- Endpoints called during database maintenance windows
Data Retention
Security Testing Policy
Edpire supports responsible security testing by integration partners under the following conditions:Standard QA Testing
Use your test organization on the production environment. Test submissions are real records but can be identified and excluded from analytics on request. No approval needed.Penetration Testing / Attack Simulation
Edpire offers a planned pen test window for clients who require the ability to run load tests, attack simulations, or chaos engineering:- A temporary isolated environment (separate Vercel deployment + isolated database) is provisioned for a defined testing period (typically 2 weeks)
- Testing is scoped to that isolated environment — production and other clients’ data are never in scope
- A written request must be submitted to support@edpire.com at least 5 business days in advance
- Testing dates, scope, and source IPs must be agreed upon before the window opens
Status & Uptime
Live platform status and incident history: status.edpire.com (coming soon) Subscribe to status updates via email at support@edpire.com.Edpire — support@edpire.com