Kustomer Outage History

## Summary On April 24, 2026, customers in our prod1 environment experienced a service event that caused elevated errors and latency in messaging-related workflows. The broad cross-customer impact was limited to approximately 41 minutes, from 3:26 PM ET to 4:07 PM ET. During that window, some customers saw failed or delayed messaging operations. The immediate platform impact was resolved the same day, and overall system health returned to normal. We then completed follow-up mitigation to stop the underlying event source and reduce the risk of recurrence. ## Impact * Customers in prod1 experienced elevated API errors and latency in messaging-related workflows. * The broad cross-customer impact lasted about 41 minutes. * A subset of messaging workflows failed or were delayed during that period. ## Timeline * **~3:25 PM ET** — A newly enabled automation began processing a large backlog of historical conversations for one tenant. * **3:26 PM ET** — Elevated errors and latency began affecting shared messaging workflows in prod1. * **4:01 PM ET** — We published a status update for the production issue. * **4:07 PM ET** — Broad cross-customer impact ended as the affected services stabilized. * **~5:17 PM ET** — We disabled the triggering automation configuration for the affected tenant. * **~5:23 PM ET** — The remaining retry activity stopped. ## Root cause The event was triggered when a newly enabled automation for one tenant processed a much larger set of eligible conversations than intended. That sudden volume overloaded a shared downstream service and caused elevated errors and timeouts in dependent workflows. The incident was amplified by missing safeguards in how this automation handled backlog volume and retries. In particular, the system did not sufficiently limit the number of conversations processed at once or prevent the same failed work from being retried too aggressively. ## Resolution We restored platform stability during the incident by allowing the affected services to recover under increased capacity, then disabled the triggering automation configuration and cleared the remaining retry backlog. System health is currently normal. ## Preventative actions We are treating the following preventative actions as a priority bug effort. These actions are expected to be resolved by the end of May in accordance with our SLOs: * Prevent newly enabled automation settings from processing large historical backlogs unintentionally. * Add stronger batch limits and tenant-level throttling for this workflow. * Reduce retry amplification by improving how failed work is tracked and re-queued. * Improve error handling so rate-limit conditions are classified correctly and handled with the right retry behavior.

## **Summary** ‌ On April 14, 2026, customers experienced errors accessing the Kustomer Knowledge Base, with all KB pages returning 500 errors. The issue was caused by a dependency upgrade in a recent deployment that introduced a TLS certificate mismatch in internal service communication. Customer impact began at 9:51 AM ET when the deployment reached the first production environment, and was fully resolved by 10:38 AM ET — a ~47 minute impact window. Engineers identified the root cause and completed a full rollback across all production environments within 12 minutes of the initial alert. ‌ ## **Root Cause** ‌ A recent deployment to the KB service included an upgrade to an internal library that contained a known issue with TLS hostname verification. This caused internal service-to-service requests to fail, resulting in 500 errors for all KB requests. The affected library version had previously been identified as problematic in a staging environment, but the fix had not been fully applied across all services before this deployment reached production. ## **Timeline** ‌ **Apr 14, 2026** ‌ 9:51 AM — Deployment reached the first production environment; customers began experiencing 500 errors when accessing the Knowledge Base ‌ 10:26 AM — Automated alerting fired; incident response began ‌ 10:31 AM — Engineers identified a recent deployment as the likely cause and began investigating rollback options ‌ 10:35 AM — Root cause confirmed as a problematic internal library version; rollback initiated across all production environments ‌ 10:37 AM — Rollback completed on prod1; KB restored for affected customers ‌ 10:38–10:39 AM — Rollback completed across remaining production environments ‌ 10:45 AM — Full KB functionality confirmed restored for all customers ‌ 12:09 PM — Corrected fix deployed to the Knowledge Base service; remediation completed across all other affected services ‌ ## **Lessons/Improvements** * Implementing stricter controls to prevent pre-release or beta library versions from being deployed to production * Improving the process for tracking and completing cross-service remediation work when an issue is identified in one service, to ensure all affected services are addressed * Enhancing our pre-production validation process to improve detection of this class of issue before it reaches production environments

## Summary On March 19, 2026, some Kustomer AI features were unavailable for customers hosted in one production environment \(Prod1\). The disruption affected AI-powered responses and related AI workflows for 41 customers in our Prod 1 instance. Other production environments were not affected. Service was fully restored within 4 hours, and the platform is operating normally. ## Root cause The incident was caused by a production database index change that was introduced during a service deployment. That change caused database performance to degrade significantly for a high-traffic dataset used by our AI services. As performance deteriorated, dependent services were unable to start or process requests normally, which led to broad disruption across affected AI features. Recovery was prolonged by duplicate records created during the incident window, which complicated restoration of normal database constraints and required additional remediation before services could be brought back cleanly. ## Timeline All times below are in EDT \(UTC-4\) on March 19, 2026. * **~10:27 AM** — A production deployment introduced a database index change that degraded performance for AI-related services. * **~10:37 AM** — Customer impact was confirmed and incident response began. * **~10:42 AM** — We published a public status update and began active mitigation. * **~11:37 AM** — We identified the primary cause and focused recovery on database stability and service restoration. * **~12:10 PM** — After scaling database capacity and reducing load, service recovery began. * **~1:43 PM** — AI services began recovering and queued work started draining. * **~2:19 PM** — Backlogged work had been processed and core functionality was restored. * **Later that afternoon** — Follow-up cleanup was completed and normal safeguards were re-applied. ## Lessons and improvements We take this incident seriously and are making changes to reduce the likelihood of recurrence. * We are tightening how database schema and index changes are deployed in production, including stronger pre-deployment validation and safer rollout sequencing. * We are removing index-management behavior from service startup paths where it can create unnecessary risk during deployment. * We are improving monitoring and alerting so service health failures and database stress are detected earlier. * We are refining incident response procedures, access readiness, and operational runbooks to speed mitigation during future incidents. * We are reviewing capacity and resilience safeguards for this part of the platform to better handle abnormal database load.

## Summary On February 20, 2026, a frontend change intended to improve performance unintentionally disrupted call setup in our Voice experience. As a result, agents could see an incoming call and click accept/decline, but audio would not connect and calls would time out. We rolled back the change and then deployed an additional fix to make startup more reliable and prevent recurrence. ## What happened When the Voice widget starts, it needs to receive a small set of configuration settings \(including feature-flag values\) from the main app before it can route and connect calls correctly. A pre-existing timing edge case meant that, in some cases, that initial configuration could be sent before the Voice widget was fully ready to receive it. Historically, the widget would receive the same configuration again shortly afterward, which masked a state issue. The performance change reduced those repeated configuration sends \(which is normally a good optimization\). But because the widget sometimes missed the first configuration during startup, it could start with incomplete settings and fall back to legacy call-routing behavior. In that fallback mode, calls could appear answerable in the UI but fail to fully connect audio. ## Root cause A performance optimization changed how/when configuration settings were delivered during Voice widget startup. Combined with a pre-existing startup timing edge case, some sessions did not receive the required configuration in time and fell back to legacy call-routing behavior, preventing audio from being bridged correctly. ## Timeline * 3:04 PM ET: Frontend change deployed * 4:38 PM ET: Reports received that calls could not be answered \(accept/decline visible, no audio\) * 4:44 PM ET: Initial rollback attempt of an unrelated change did not resolve the issue * 4:50 PM ET: Incident communication initiated via status page * 6:24 PM ET: Frontend change reverted/rolled back * 8:47 PM ET: Reports continued for some agents * 10:31 PM ET: Identified that affected sessions could persist without a browser refresh due to cached UI state; refresh/new session restored correct behavior * Saturday 9:00 AM ET: Confirmed reports that calls were successfully connecting ## Lessons / improvements * Harden Voice widget startup so required configuration can’t be missed during initialization. * Add automated smoke/E2E coverage for core Voice call flows \(answer/connect audio\) to detect regressions before production. * Improve safeguards and monitoring around call-connect failures to reduce time-to-detect and time-to-mitigate.