> ## Documentation Index
> Fetch the complete documentation index at: https://docs.edpire.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Technical Limits & Infrastructure

> Rate limits, usage quotas, response time guarantees, infrastructure stack, and security testing policy.

**Effective date:** 2026-05-01

This document is intended for technical teams evaluating or building on top of the Edpire API.

***

## Infrastructure Overview

| Component          | Technology                                                   |
| ------------------ | ------------------------------------------------------------ |
| API & web platform | Vercel (serverless functions + Edge Network)                 |
| Database           | PostgreSQL (self-hosted VPS) via PgBouncer connection pooler |
| File storage       | Cloudflare R2 (S3-compatible)                                |
| CDN                | Cloudflare                                                   |
| Primary region     | Europe (EU)                                                  |

**Compute auto-scaling:** Vercel serverless functions scale automatically with traffic. There is no warm-up period on primary API routes. Cold starts do not apply to Edge-deployed routes.

**Database scaling:** PgBouncer pools connections to the PostgreSQL instance, preventing connection exhaustion under concurrent load. The database is the primary scaling constraint — see rate limits below for the limits that protect it.

***

## API Rate Limits

Rate limits are applied **per API key**, on a rolling 60-second window. When a limit is exceeded, the API returns `429 Too Many Requests` with a `Retry-After` header indicating how many seconds to wait before retrying.

| Endpoint category                                          | Limit                 |
| ---------------------------------------------------------- | --------------------- |
| All REST endpoints (general)                               | 300 requests / minute |
| `POST /assessments/{id}/submit` (full assessment submit)   | 100 requests / minute |
| `POST /assessments/{id}/check` (per-question answer check) | 600 requests / minute |

**Burst behavior:** Short bursts above the limit may be absorbed by token-bucket smoothing. Sustained traffic above the limit will consistently return `429`.

**Shared limits:** Rate limits apply to the API key, not to individual learners. If your integration routes all learners through a single API key (standard setup), design your backend to aggregate and respect these limits.

***

## Monthly Usage Quotas

Usage quotas reset on the **1st of each calendar month** at 00:00 UTC.

### Submission Quota

A submission is counted each time a learner completes and submits a full assessment, through any delivery path: the REST API (`POST /assessments/{id}/submit`), the embedded SDK player, or an Edpire-hosted share link. Partial saves, draft states, and preview calls are not counted.

| Tier       | Active users | Included submissions / month |
| ---------- | ------------ | ---------------------------- |
| Starter    | ≤ 500        | 30,000                       |
| Growth     | ≤ 2,000      | 120,000                      |
| Enterprise | Custom       | Custom                       |

### API Call Quota

An API call is counted for each request to the `/check` endpoint or any read endpoint (GET requests). Write endpoints other than `/submit` (e.g., webhook registration) are not counted against this quota.

| Tier       | Active users | Included API calls / month |
| ---------- | ------------ | -------------------------- |
| Starter    | ≤ 500        | 500,000                    |
| Growth     | ≤ 2,000      | 2,000,000                  |
| Enterprise | Custom       | Custom                     |

***

## Overage Billing

When a quota is exceeded, calls are not blocked — they continue to succeed and are billed as overage at the end of the billing period.

| Quota       | Overage rate                            |
| ----------- | --------------------------------------- |
| Submissions | 50 TND per 5,000 additional submissions |
| API calls   | 20 TND per 50,000 additional API calls  |

Overage is billed in whole blocks. Partial blocks are rounded up. Edpire sends an email notification when usage reaches **80%** and **100%** of the included quota.

***

## API Response Times

The following commitments apply to production API endpoints under normal load:

| Metric            | Commitment  |
| ----------------- | ----------- |
| p95 response time | \< 400 ms   |
| p99 response time | \< 1,000 ms |

**Excluded from response time guarantees:**

* Endpoints that trigger AI evaluation (grading latency depends on third-party model response times)
* File upload endpoints (latency scales with file size)
* Endpoints called during database maintenance windows

***

## Data Retention

| Data type                    | Retention period                          |
| ---------------------------- | ----------------------------------------- |
| Submission results           | Indefinitely while subscription is active |
| Webhook delivery logs        | 90 days                                   |
| API access logs              | 30 days                                   |
| Data after subscription ends | 60 days (export window), then deleted     |

***

## Security Testing Policy

Edpire supports responsible security testing by integration partners under the following conditions:

### Standard QA Testing

Use your test organization on the production environment. Test submissions are real records but can be identified and excluded from analytics on request. No approval needed.

### Penetration Testing / Attack Simulation

Edpire offers a **planned pen test window** for clients who require the ability to run load tests, attack simulations, or chaos engineering:

* A temporary isolated environment (separate Vercel deployment + isolated database) is provisioned for a defined testing period (typically 2 weeks)
* Testing is scoped to that isolated environment — production and other clients' data are never in scope
* A written request must be submitted to [support@edpire.com](mailto:support@edpire.com) at least **5 business days** in advance
* Testing dates, scope, and source IPs must be agreed upon before the window opens

Unauthorized testing against the production environment or other clients' data is prohibited and may result in immediate account suspension.

***

## Status & Uptime

Live platform status and incident history: **status.edpire.com** *(coming soon)*

Subscribe to status updates via email at [support@edpire.com](mailto:support@edpire.com).

***

*Edpire — [support@edpire.com](mailto:support@edpire.com)*