Enterprise
Extended support for enterprise estates
Enterprise open source support from OSSeva is one contract for every database, broker and runtime in your estate, including versions the community no longer patches. It brings signed patched builds, 24/7 support, audit evidence and a named engineer, quoted per cluster or application. You buy it through a 15-minute call.
- Covers
- Databases, brokers and runtimes on one contract, current and end-of-life versions
- Patch window
- Critical CVEs (CVSS 9.0 or higher) within 48 hours, High within 7 days, every technology
- Support
- 24/7 reactive on Assure. 24/7 monitoring and a 15-minute P1 response on Operate
- Named engineer
- Named senior engineer on Operate. Dedicated Partner for ongoing engineering work
- Where it runs
- Your data centre, your cloud account or your Kubernetes clusters
- How you buy
- A 15-minute call, the versions in scope, then a quote per cluster or application
Last reviewed
Trusted globally by enterprises
What enterprise open source support has to include
Open source software is free to use, but nobody is obliged to patch an old version, answer a page at night or produce audit evidence. An enterprise support contract puts those duties on a vendor. Check five things in any open source support contract:
- Patches for the versions you run, including end-of-life lines, with a stated patch time by severity. OSSeva patches Critical CVEs within 48 hours and High within 7 days.
- Response times and a support level that fit your operations. Assure gives 24/7 reactive support. Operate adds a 15-minute P1 response.
- Evidence for auditors: a signed build, an SBOM and a CVE record for every build.
- One vendor across the stack, so one security review, one renewal date and one escalation path.
- No vendor lock-in. Patches apply to upstream source with no fork, and if you stop the subscription you keep running the last patched version.
One contract for the whole portfolio
A portfolio contract replaces one agreement per technology with one agreement, one renewal date and one escalation path. Current and end-of-life versions sit on the same contract, so bringing a system under support does not force an upgrade first.
| Layer | Technologies | Where to check your version |
|---|---|---|
| Databases | PostgreSQL, MySQL, MariaDB, MongoDB, Redis, Valkey, Elasticsearch, ClickHouse | Supported versions and each technology page |
| Messaging and streaming | RabbitMQ, Apache Kafka, ActiveMQ Artemis, Apache Pulsar, ZooKeeper | Supported versions |
| Application runtimes | Spring Boot, Spring Framework, Apache Tomcat, Node.js, .NET, and Erlang/OTP under RabbitMQ | Supported versions |
Each technology is counted in its own unit, such as a cluster, an application or an application runtime environment. The pricing page lists the unit for every technology and what moves a quote. Adding cores, memory or replicas to a cluster does not change the count.
Where the estate runs
Your data centre
Bare metal and virtual machines in your own facilities. Patched builds ship as packages and tarballs, so the way you install software stays the same.
Your cloud account
Instances inside your own cloud account and VPC, with whichever provider you use. The account and its data stay yours.
Your Kubernetes clusters
Patched builds are also published as container images and Helm charts, so operators and GitOps pipelines keep working.
Air-gapped and private networks
Builds go to your internal Artifactory, Nexus or Harbor, so production needs no outbound internet access.
What each tier adds
| Tier | What the contract adds | Commitment |
|---|---|---|
| Patch | Signed patched builds for current and end-of-life versions, CVE records, vulnerability disclosure notifications | Critical CVEs within 48 hours, High within 7 days |
| Assure | Everything in Patch, plus an annual architecture audit, upgrade planning, a named architecture consultant, compliance evidence and 24/7 reactive support | Same patch window, 24/7 reactive support |
| Operate | Everything in Assure, plus 24/7 monitoring, runbooks, a named senior engineer, quarterly business reviews and rolling upgrades | 15-minute P1 response, 24/7 |
The patch window is the same on every tier. The full matrix, with priorities, scope and exclusions, is on the SLA page.
Named engineers and the Dedicated Partner
Named people appear in three places. Every Operate account has a named senior engineer. Assure has a named architecture consultant. A Dedicated Partner is a named senior engineer for ongoing work.
Some enterprise work does not fit a ticket queue: upgrades, migrations, tuning and reviews that nobody on your team gets to. A Dedicated Partner is a named senior engineer who learns your stack and stays on it, for one fixed monthly fee. There is no hourly billing.
- Works your backlog: upgrades, migrations, tuning, reviews and the work your team never gets to
- Joins your standups, tickets and chat channel like a member of your team
- Sends a monthly report of what was done, what is next and what we see coming
- Runs next to Assure or Operate, which carry the 24/7 commitments
A Dedicated Partner is not the pager. 24/7 reactive support comes with Assure, and monitoring plus the 15-minute P1 response come with Operate. The model is set out in full under Dedicated Partner. Ask about term and cover arrangements on the call, because this page does not publish them.
Evidence for auditors
Large buyers are asked for proof by auditors, customers and regulators. Each patched build comes with a signed artifact, an SBOM, VEX statements and a CVE record that shows what was fixed, when and in which build. Assure adds compliance documentation written for SOC 2, HIPAA, PCI DSS and ISO 27001 audits.
The audit acceptance guide shows how auditors review this evidence. Audit evidence for end-of-life open source maps it to the rules, and the compliance matrix sets it against each framework.
Security review and procurement
Supplier reviews usually ask the same questions. The answers are in one place each:
Security review
The trust center lists the attestations OSSeva holds today, including a SOC 2 Type II report under NDA, and how builds are signed. The security page has the disclosure policy and the signing key ID.
Contract terms
The SLA page sets patch times, response times, scope and exclusions by tier in plain text.
Procurement route
The procurement guide lists what to require from any open source support vendor. The CISO page covers compliance documentation.
How an enterprise contract is bought
| Step | What happens |
|---|---|
| 1. Discovery call | A 15-minute call to confirm the technologies, versions and clusters in scope, and the frameworks your auditors work to. |
| 2. Scope | We map every contract you want to replace and the units behind it. Bring a list of clusters by technology and version. |
| 3. Quote | A quote per cluster or application, not per core. The drivers are the units in scope, the versions you run, the tier, whether you need 24/7 cover and the evidence your auditors ask for. |
| 4. Supplier review | Your security and procurement teams review the SOC 2 Type II report under NDA, the SLA and the contract. |
When another supplier is the better fit
You want the databases hosted for you
OSSeva supports software you run on your own infrastructure. A managed service from your cloud provider fits better if you want the vendor to host it.
An engine depends on a proprietary distribution
Oracle-compatible PostgreSQL, MySQL Enterprise components or Redis Software's Active-Active replication belong with the vendor that builds them. Consolidate the rest around them.
You want a Dedicated Partner to carry the pager
The Dedicated Partner is engineering capacity. Pair it with Assure or Operate for 24/7 cover.
Can one contract cover PostgreSQL, Spring and .NET?
Yes. One OSSeva contract covers every technology in scope, current and end-of-life versions alike, with one renewal date and one escalation path. Each technology is counted in its own unit: PostgreSQL per cluster, Spring Boot per application and .NET per application runtime environment. The patch window is the same for all of them: Critical CVEs within 48 hours and High within 7 days.
Do you support air-gapped estates?
Yes for build delivery. Patched builds go to your internal Artifactory, Nexus or Harbor, so production needs no outbound internet access. Operate works through the access you grant, and the account and its data stay yours.
How fast can you onboard 200 servers?
Onboarding is scoped per estate, so this page gives no fixed duration. OSSeva counts clusters and applications rather than servers, so the useful numbers to bring to the call are clusters by technology and version. Patch and Assure start with the versions in scope. Operate starts with an inventory of topology, versions, monitoring gaps and runbook status, and monitoring and runbooks are in place before we go live. Taking over support does not start with a migration: you keep the binaries, data and topology you run today.
Who are the named engineers?
Every Operate account has a named senior engineer, Assure has a named architecture consultant, and a Dedicated Partner is a named senior engineer. This page does not list individuals. Ask on the discovery call who would be assigned to your estate.
Get a quote
Talk to an enterprise lead.
Book a 15-minute call or phone us. Bring your clusters by technology and version, and the contracts you want to replace.