Rate-limit counters are regional and are not replicated. A globally strict quota would put a cross-region round trip on the hot path, which is a 60 to 90 ms floor against a 10 ms budget — it would defeat the entire design.
Each region receives a share of every tenant's quota, weighted by observed traffic, and the global reconciler corrects the split every 60 s. A tenant sending all its traffic to one region gets its full quota there within a minute.
PostgreSQL is a single global primary with a regional read replica. Policy writes are rare and can tolerate a cross-region write; policy reads never happen on the hot path at all.
Availability arithmetic
Target 99.99%, which is 52 minutes per year. Two active regions behind latency-based GeoDNS, with each region independently capable of serving the full load at degraded latency.
Valkey: 16 shards, one replica each, spread over 3 AZs. Loss of one AZ costs at most a third of the shards and triggers automatic replica promotion in under 15 s.
RTO for a full region loss is DNS-bound: 60 s TTL plus resolver behaviour, in practice 2 to 3 minutes. RPO for usage data is 0 because Kafka is written before the response returns.
Risks
During a region failover, the surviving region briefly enforces only its own share of each quota, so tenants see spurious 429s until the reconciler rebalances. The reconciler runs on an accelerated 10 s cycle when a region is marked down.
The self-hosted GPU pool is single-region. Tenants routed to it from the other region pay cross-region latency on the completion, though not on the decision.
Kafka and ClickHouse are deployed in the primary region only. A primary region loss stops usage aggregation — billing catches up on recovery from the 7-day retention window, but live budget enforcement degrades to last-known values.
