Each nine divides the downtime by ten and, roughly, multiplies the engineering by the same. The first ones are nearly free — a single well-run server gets you two. The last ones are somebody's whole career.
If your service needs a database, an auth provider and an object store, and each is up 99.9% of the time, your service is not up 99.9% of the time. It is up 0.999 × 0.999 × 0.999 = 99.7%, which is 26 hours a year rather than 8¾. Three excellent dependencies produced a mediocre service, and nobody did anything wrong.
This is why the rule’s own failure mode matters more than the rule. Chasing four nines on top of a three-nines dependency is not expensive — it is impossible. The cost curve does not steepen, it goes vertical, and the only ways past it are removing the dependency, making it optional, or duplicating it.
Two copies of a 99.9% component give 99.9999% — if they fail independently. They rarely do. They share a region, a deployment pipeline, a certificate, a configuration push, a dependency of their own. Correlated failure is the normal case, and it is why real multi-instance systems never reach the number the arithmetic promises.
Treat the redundancy figures here as a ceiling nothing reaches, in exactly the way the dependency figures above are a floor you cannot rise above.
A published availability figure is not an engineering commitment. It is the threshold below which the provider owes you a service credit — typically a percentage off next month's bill, capped, and usually only if you notice and claim it within a window.
Which means the compensation is bounded by what you pay them, and your loss is not. An hour of downtime that costs your business ten thousand pounds is refunded with a few pounds off a cloud bill. The SLA prices the provider's risk, not yours.
Two more details worth knowing. The measurement window is usually the calendar month, so February gives you fewer absolute minutes than March at the same percentage — the selector above lets you see the difference. And what counts as "down" is defined by the provider: partial degradation, elevated error rates and slow responses frequently do not qualify, even when they are indistinguishable from an outage to your users.
This page has changed in 2 archived releases, but each of those was a site-wide pass, so none is attributable to this tool on its own and none is listed here. That is not a claim that the tool never changed — a release that reworked many pages at once may well have altered this one too. The changelog has them.