Services for Enterprise customers are guaranteed to be available and responsive 99.9% of the time. If we don't meet this guarantee you are eligible for a service credit as described below. Check our Status page for a history of our reliability.
This Enterprise Service Level Agreement only applies if your enterprise contract with us specifically references this Service Level Agreement. The Mapbox APIs used by you within the limits set forth in your plan or Order (including any Overages), will be available 99.9% of the time every month. If we do not meet this guarantee, you will be eligible to receive a Service Credit as described below.
An API will be considered unavailable when it is inaccessible during two or more consecutive 90-second intervals. If an API is accessible in some regions but not others, availability for the API for the relevant time period will be calculated as the fraction of your API requests that are failing worldwide. Uptime in a month will be calculated across APIs based on the uptime of each individual API you use during the month, weighted by the fraction of all your API requests accounted for by each API during that month. For purposes of this guarantee, a "month" means a calendar month.
Service credits are calculated as a percentage of the total charges you owe us for services each month, or your annual fee divided by 12, as follows:
(across all APIs) per month
100% - 99.9% - 0% Credit Amount
99.89% - 99% - 10% Credit Amount
Less than 99% - 25% Credit Amount
To receive a credit, you must contact us within 30 days following the end of the unavailability via email at info@mapbox.com and include the dates and times of unavailability. If we confirm that the uptime percentage in a month covered by your request is below 99.9%, we will issue you the service credit. Service credits (i) may be applied to any future invoice issued by us to you (including renewals, subsequent orders and overages), (ii) cannot be exchanged for, or converted to, monetary compensation, and (iii) will expire if not used within twelve months of being issued. The maximum service credit that we will issue for downtime in a month is 25% of the fees you otherwise owe us for that month.
This Service Level Agreement is your sole and exclusive remedy (and our sole liability) for unavailability of our Services.
A period of unavailability is excluded from the service level guarantee, and will not count towards unavailability calculations for purposes of service credits, if:
Last Updated: December 2022
No. Mapbox is an API and SDK platform company. Mapbox customer end user applications send structured requests to Mapbox and then receive (from Mapbox) the requested information (e.g., a specific map tile or route from A to B).
No. However, some customers do choose to upload map data to Mapbox for distribution to their end users. Customers may elect to use Mapbox Upload APIs (currently, Uploads, Tilesets and Datasets), although customers may also technically restrict their developers from using the Upload APIs through token scoping.
Data Processor. Mapbox’s Data Processing Addendum (“DPA”) is incorporated into any applicable agreement with its customers and scoped broadly enough to encompass many global privacy laws. Mapbox's goal is to provide transparency about the data entrusted to it, how such data is used, and the technical and organizational measures designed to protect such data.
Yes. Mapbox is SOC2 Type 2 certified and its summary SOC3 report is available for customer review. Upon request and execution of an NDA, Mapbox may share a copy of its latest SOC2 report.
Mapbox takes privacy and data security very seriously and implements processes designed to operate in compliance with: VCDPA (Virginia, USA), UK-GDPR (UK), GDPR (Europe), CTDPA (Connecticut, USA), CCPA and its implementing regulations including CPRA (California, USA, and APPI (Japan), among many other important jurisdictions.
Mapbox runs a global data protection program, based on privacy by design, which includes monitoring for upcoming privacy laws and regulations to assess whether its practices may need to be adjusted to maintain compliance; product/service privacy reviews; data breach response processes; and operationalized technical and organizational measures designed to ensure the security of the personal data it receives including: security audits and SOC2 certification; encryption of IP addresses in transit and at rest; pseudonymization of personal data (where applicable); strict access control with logging; limited data retention periods.
In some jurisdictions consent from the end user may be required to collect and process location based data (e.g., Virginia and Connecticut). To the extent customer’s end users are in such locations and customer’s application is implicated by these laws, customer shall obtain end users' affirmative express consent before making available to such end users Mapbox products/services within the customer’s licensed application that collects or processes location data. Additionally, customers shall at all times allow end users to opt out of location data sharing using one of the methods described in Mapbox’s developer documentation.
Please see Mapbox DPA, Schedule B to learn what personal data may be collected and how it is used. Mapbox applies the principle of data minimization to product development and operations in an effort to ensure the least amount of personal data is collected from the outset. Regarding the limited personal dataset that Mapbox processes, it has implemented a number of technical and organization measures designed to ensure data protection, including prompt deletion of raw log files that contain IP addresses and billing IDs. For billing IDs, which need to be retained for accounting and billing purposes, Mapbox deploys regular ID rotation and 1-way hashing to minimize the ability to track user requests over time. In addition, Mapbox operates strict de-identification procedures, such as clipping traces, for telemetry events that send location data.
Transmission of information across the Internet requires the presence of IP addresses, which define where information will be sent and where such data is coming from. When end users engage with applications that access Mapbox products/services over the Internet, the end user necessarily discloses their current IP address to one or more Mapbox servers.
The United States. However, for performance purposes, Mapbox regularly caches content on its AWS CDN network located in various regions. When content is unavailable in the CDN cache or where the API service requires custom calculations, the requests are routed to the US for processing. Mapbox also utilizes the services of employees who work for Mapbox wholly-owned subsidiaries in order to support, develop and provide its products/services.
No. Mapbox’s products/services store and serve source data from an AWS primary region in the US. Data is sometimes cached and served out of various regions outside the US for performance reasons, as described in the questions/response above, but Mapbox cannot serve its data from one limited geographic region. To safeguard such transfers to the US and other regions, please see Mapbox's DPA, Schedule C, which includes the Standard Contractual Clauses released in 2021 by the European Commission.
No. Mapbox does not sell personal data or build targeted profiles with personal data processed through its products/services.
No. For customers on a monthly active user (“MAU”) billing model, Mapbox maintains counts of such MAUs for billing purposes only. Mapbox does not (and cannot) track an end user’s activity across such 30 day billing cycles.
Mapbox welcomes any further questions you may have regarding its ongoing commitment to privacy and data security. Please contact Mapbox’s privacy office at privacy@mapbox.com.
Please subscribe below: