Hue Draw
Service level agreement
This agreement backs the chart catalogue. The tiers are the Business and Enterprise plans, set out in pricing.
- two tiers
- four severities, each on a clock
- 24-month LTS
- digests frozen inside a major
- perpetual use
These are the terms offered. The agreement is signed with an organisation holding Enterprise, after its purchase, and binds once both parties sign it.
1. The parties and what this agreement covers
This agreement is between the supplier of Hue Charts (the operator) and the customer: an organisation holding an Enterprise plan, which signs it with the supplier after its purchase. It binds once both have signed it, and covers support of the Software for the term in clause 14.
2. Definitions
- Software: the hue-charts library as released, Hue Web Components, both MCP servers and the Power BI visual.
- Release line: a series of releases sharing a major version and kept as clause 7 sets out.
- Digest: the eight-hex-digit FNV-1a hash of a chart's raster, which every chart hands back.
- Spec: a chart's slug, options, theme and data, or a recipe; the input that fixes a picture.
- Report: a defect, question or security finding sent through the tier's channel.
- Business hour and business day: 09:00 to 17:00 UK time, Monday to Friday, outside UK public holidays.
- Response: a person's first reply that has read the report and states its severity. Fix: a release, or a workaround the customer accepts, that ends the fault.
3. Scope
Covered: the Software on a supported release line (clause 7), unmodified, in a JavaScript engine that implements ECMAScript 2024 and IEEE 754 double arithmetic (every current browser, Node.js 24 and later, Deno and Bun). Not covered: copies the customer has modified, unsupported lines, the customer's own code and data, and faults in a browser or runtime, for which the supplier gives a workaround where one exists.
4. Service tiers
| Business | Enterprise | |
|---|---|---|
| Who it is for | One organisation, every person in it | One organisation, every person in it |
| Support channel | Email, a reply the next business day | Email and a named contact, answered on the clock in clause 6 |
| Response clock (clause 6) | The next business day | The clock in clause 6 |
| Release lines (clause 7) | Current, LTS and maintenance | Current, LTS and maintenance |
| Picture guarantee (clause 8) | As published | Written into the agreement |
| Accessibility report (clause 9) | Published, with each minor | Published, with each minor |
| Security (clause 10) | Advisories and fixes | Advance notice before disclosure |
| What it draws | Every chart and everything in it: the kernel's colour, the Display P3 read-out, accessibility, and every file, PNG, SVG, CSV, the PDF and the print PDF (PDF/X-4), from the paid packages, with no credit | Every chart and everything in it: the kernel's colour, the Display P3 read-out, accessibility, and every file, PNG, SVG, CSV, the PDF and the print PDF (PDF/X-4), from the paid packages, with no credit |
| Documents | The WCAG 2.2 AA report, the SBOM, the SECURITY file and five years of security fixes on every major come with every plan; the standards and law pack, with the data statement | The WCAG 2.2 AA report, the SBOM, the SECURITY file and five years of security fixes on every major come with every plan; the pack; its security and procurement questionnaires answered, a data processing agreement drafted on request |
| Licence | The Hue Charts Licence, through the paid packages, which draw no credit: no key, no call home, no domain lock | The Hue Charts Licence, through the paid packages, which draw no credit: no key, no call home, no domain lock |
| Price | £1,000 a year or £100 a month | £5,000 a year or £500 a month |
No tier calls home, locks to a domain or needs a network: a plan gives the paid packages, which draw no Hue Charts credit, and the Power BI visual, built from them, and nothing checks the plan. The one chart that fetches a live forecast draws its sample without a network.
5. Support hours and channels
Reports are taken at any time and answered on the clocks in clause 6, counted in business hours and business days. Security findings go through the private channel in clause 10, never a public issue.
6. Severity and the clock
The supplier sets the severity on its response, and the customer may ask for it to be reviewed. The clock starts when a report with the information in clause 11 is received.
| Severity | For example | Response within | Fix within |
|---|---|---|---|
| 1 · Critical | Code execution, data leaving the page, a supply-chain compromise of the package | 4 business hours on Enterprise; the next business day on Business | 7 days, on every supported line |
| 2 · High | A spec or recipe that hangs or crashes the renderer; a broken picture guarantee (clause 8) | The next business day | 14 days |
| 3 · Medium | Wrong output a reader could act on: a mislabelled axis, a wrong value in the data table; an accessibility regression (clause 9) | The next business day | The next patch release |
| 4 · Low | Cosmetic faults and questions | The next business day | The next minor release |
7. Releases and long-term support
Versions follow semantic versioning. A patch fixes without changing an API or a picture. A minor adds without breaking. A major may break, and its notes list every break with the way across. Nothing is removed without a minor release that warns first and names the replacement.
| Line | Which releases | What it receives | For how long |
|---|---|---|---|
| Current | The newest minor release | Features, fixes and security | Until the next minor |
| LTS | Every major; 0.x is pre-LTS | Security and critical fixes; no new features, no picture changes | 24 months from its first release |
| Maintenance | An LTS line after its support period | Security fixes only, free of charge | Until five years after the major's first release |
Every release is cut in a clean clone at its tag, checked as a stranger installs it, and ships a CycloneDX SBOM listing each file with its SHA-256, with an SPDX one beside it.
8. The picture guarantee
Within a major version, the same spec, from the same package, gives the same digest on every covered engine and in every release. The digests are tested in Node, Deno and Bun on every release; browsers are held to them by the maths' design and by this clause. A chart's movement is part of its picture: the frame at a moment carries its digest, and the settled frame is the chart's. The library's tests pin the digest of every chart on both grounds, and a release does not ship if one moves. A spec whose digest differs between two covered engines, or between two releases of one major, is a severity 2 defect. Its fix restores the digest, or, where the earlier picture was wrong, is held for the next major and named in its notes. A chart drawn on the GPU is drawn exact, its bytes the raster's, and only on a GPU that has passed the proof on that machine; any other draws it on the raster.
9. Accessibility
The Software is self-assessed against WCAG 2.2 level AA, criterion by criterion, in the accessibility section, which says where a criterion is only partially supported and is republished with each minor release. A release that falls below the report is a severity 3 defect.
10. Security
Security findings are reported privately, by email to support@chromaticcoherence.ai with "Security" in the subject, until the library's repository is public. Each is handled on the clock in clause 6, fixed on every supported line, and disclosed with a CVE once the fix ships. Where the EU Cyber Resilience Act sets a shorter time for reporting, that time applies. The Software has no runtime dependencies, and its input is the spec, which is checked against its JSON Schema and never run as code.
11. What the customer provides
- A report on a supported line, naming the version.
- The spec that shows the fault, or the smallest one that does, and the engine and its version.
- The digest the customer saw, and the one expected, where the fault is in a picture.
- Reasonable help to reproduce the fault, and the fix applied once it is released.
12. Service credits
No tier earns service credits. The remedies for a missed clock are the customer's in law.
13. Exclusions
The clock in clause 6 does not run while the supplier waits on information from clause 11, or for faults outside the scope in clause 3. Force majeure suspends the clock for as long as it lasts.
14. Term
This agreement runs with the customer's Enterprise plan, for its period, from the day both parties sign it, renews as the plan renews, and ends with the plan. Until it is signed, the customer's support is Business's. The right to use the Software is the Hue Charts Licence's and does not end with this agreement: the Software keeps working, with no key to expire and nothing to call home. Support for a version ends with its release line.
15. Changes to these terms
The supplier may improve these terms at any time, and does not reduce them during a customer's term. The terms are reviewed once a year.