Deploy

Production readiness

Use this checklist before enabling real customers or live response. AURA production access and operational signoff are separate from technical success in staging.

Security

  • Keep production credentials in a secrets manager and separate from staging.
  • Request server tokens only from trusted backend infrastructure.
  • Redact bearer tokens, mobile numbers, customer profiles, location, and payment data from routine logs.
  • Restrict production access to the people and services that need it.
  • Validate any customer identity or payment callback before changing entitlement.

Reliability

  • Set explicit connection and request timeouts.
  • Retry transient failures with bounded exponential backoff and jitter.
  • Honour 429 rate-limit headers.
  • Make webhook processing idempotent and acknowledge only after durable processing.
  • Monitor token failures, callout creation failures, webhook failures, latency, and unusual retry volume.

Customer safety

  • Check active subscription entitlement before exposing panic functionality.
  • Check the required response type at the customer’s address or coordinates before selling or activating protection; do not infer coverage from country availability alone.
  • Make the panic action easy to find and difficult to trigger accidentally.
  • Keep location current during an active mobile callout.
  • Show a clear in-progress state when the API outcome is uncertain; do not tell the customer help is dispatched until the callout is confirmed.
  • Provide a tested cancellation path and visible support route.

Data and ownership

  • Retain the mapping between your IDs and AURA customer, subscription, location, and callout IDs.
  • Define which system owns profile, subscription, and Fixed Location updates.
  • Establish retention and access rules for customer and location data.
  • Confirm commercial ownership of payment, refunds, subscription expiry, and customer support.

Operational handoff

Before launch, agree:

  • production customer source, regions, response types, and subscription types;
  • webhook endpoint and any custom authentication headers;
  • test-callout process and launch window;
  • support contacts and escalation path;
  • monitoring owner and incident-response process;
  • rollback or customer-disable procedure.

Complete the People Protect, Property Protect, or white-label checklist for the product-specific requirements.