99.99% Availability

The Downtime Math

 99.99% → 0.01% failure budget

 per YEAR    ≈ 52.6 minutes down    (525,600 × 0.01%)
 per MONTH   ≈ 4.4 minutes          (43,800 × 0.01%)
 per WEEK    ≈ 1.0 minute
 per DAY     ≈ 8.6 seconds

Four nines means the whole month’s allowance is one medium incident — or nothing.

Why Multi-AZ Alone Stops Being Enough

Three nines tolerates losing an AZ because recovery fits the budget. Four nines cannot afford even the detection and failover window of many single-region events:

 typical single-region failure timelines:
 AZ network event: detection 1–5 min + failover 2–10 min
                   → already spent half a MONTH of budget per event
 
 regional control-plane degradation: hours; budget annihilated

 conclusion at four nines:
 - every component redundant ACROSS AZs with automated, tested failover
 - regional-level blast radius must be survivable (read replicas in
   second region at minimum; active-active for money paths)
 - deploys can no longer measurably raise error rates
   → progressive delivery (canary, auto-rollback) becomes mandatory

The Engineering Bill

Practice	At three nines	At four nines
Database	Primary + standby, automated promotion	Quorum-based or synced multi-AZ; tested RPO≈0
Deploys	Rolling, brief errors OK	Canary + automated analysis + instant rollback
Dependencies	Timeouts/retries	Bulkheads + circuit breakers + fallbacks everywhere
Testing	Staging coverage	Chaos drills; game days; failover rehearsed quarterly
On-call	Standard rotation	Deep runbooks; error budgets enforced politically

The last row is the honest cost: four nines is as much organizational discipline as architecture. Most outages at this tier are change-induced — so change management becomes the availability mechanism.

Who Actually Runs Four Nines

• Payment capture and ledgers — contractual penalties per minute.
• Ride matching / order taking at market-leader scale — each down minute is revenue plus trust.
• Auth/identity for large fleets — being down logs out the world.
• Health/safety-critical flows — non-negotiable tiers.

Everything else in those same companies still runs happily at 99.9% — tiering by path remains the pattern; nobody four-nines their admin panel.

The Measurement Caveat

Published “five nines” claims usually measure component uptime, not user-experienced availability. Client-measured availability is always worse than server-side numbers: networks, DNS, client bugs all subtract. Design to the number you measure from the user’s chair.

Interview Framing

Claiming four nines triggers immediate cost questions. Strong answers accept the bill explicitly: “four nines on payment capture means quorum-synced storage across AZs, canary-only deploys, and rehearsed failover — that tier is why payments is its own service.” Refusing to apply it broadly (“everything else stays at three nines”) is the calibration interviewers reward.