JBNX · projects.jbnx.io/framework/ready
Production & Subscription Readiness Framework
Version 3.0 — a scored audit for taking a web app to production and selling subscriptions against it. Synthesized from Google SRE Production Readiness Reviews, Cortex and OpsLevel PRR checklists, and SaaS billing and launch guides.
Raw markdownJSON
How to use it
- Pick your stage tier — it defines which items are required rather than deferred.
T1 (MVP Launch): first paying customers, single region, small team.
T2 (Growth): real revenue, on-call exists, multiple environments.
T3 (Scale): SLAs to customers, compliance obligations, multi-team.
- Score each pillar 1–10 against the rubric below. Every item requires evidence — a link, screenshot, test run or dashboard. Self-attestation without evidence caps that item's pillar at 6.
- Compute the weighted composite and check the launch gates.
Universal scoring rubric
| Score | Anchor |
|---|
| 1–3 | Absent or ad-hoc; no evidence |
| 4–6 | Partially implemented; manual; untested under failure |
| 7–8 | Implemented and tested; evidence exists; gaps documented with owners |
| 9–10 | Implemented, tested, automated and monitored, and verified within the last 90 days |
Launch gates.
Go-live (T1): every pillar ≥ 6, and Security, Billing and Legal ≥ 7 — no exceptions on those three.
Scale-up (T2→T3): every pillar ≥ 7, composite ≥ 8.0.
Any gap below a gate gets a written exception with an expiration date and a remediation owner — or it blocks launch.
Pillar weights
| Pillar | Weight |
|---|
| 1. Reliability & Infrastructure | 15% |
| 2. Security & Compliance | 15% |
| 3. Observability & Operations | 10% |
| 4. Performance & Scalability | 10% |
| 5. Billing & Subscription Infrastructure | 15% |
| 6. Pricing & Packaging | 10% |
| 7. Conversion Funnel & Growth | 10% |
| 8. Retention & Revenue Health | 5% |
| 9. Legal & Trust | 5% |
| 10. Support & Customer Success | 5% |
Composite = Σ (pillar score × weight).
Pillar 1 — Reliability & Infrastructure (15%)
Can the app stay up, recover, and redeploy safely?
| Item | Tier | Evidence |
|---|
| Reproducible deploys via CI/CD; no manual prod changes | T1 | Pipeline run link |
| Rollback tested, not just documented | T1 | Rollback drill record |
| Automated DB backups + restore actually tested | T1 | Restore drill log |
| Health checks + auto-restart on the platform | T1 | Config + uptime log |
| Staging environment matching prod | T2 | Env diff |
| Defined RTO/RPO; DR runbook exercised | T2 | Drill report |
| Multi-AZ/region, or documented acceptance of single-point risk | T3 | Architecture doc |
| Infrastructure as code | T3 | Repo link |
Pillar 2 — Security & Compliance (15%)
Would a breach or an audit end the business?
| Item | Tier | Evidence |
|---|
| Auth via proven provider/library; MFA available; session expiry | T1 | Config review |
| Secrets in a manager — never in code or client bundles | T1 | Repo scan output |
| OWASP Top 10 pass: injection, XSS, CSRF, IDOR/authz on every endpoint | T1 | Scan report + manual authz test |
| TLS everywhere; security headers (CSP, HSTS) | T1 | Scanner grade |
| Dependency scanning + patch cadence | T1 | CI job |
| Row-level security / tenant isolation verified with negative tests | T1 | Test suite |
| Least-privilege access for humans and services; offboarding process | T2 | Access review |
| Pen test or structured external review | T3 | Report |
| SOC 2 / ISO track if selling to companies that ask | T3 | Roadmap or report |
Pillar 3 — Observability & Operations (10%)
When it breaks, do you find out from your dashboard or from Twitter?
| Item | Tier | Evidence |
|---|
| Structured, centralized, searchable logs — no PII or secrets in logs | T1 | Log query demo |
| Error tracking with alerting (Sentry-class) | T1 | Alert screenshot |
| Uptime monitoring from outside your infra | T1 | Monitor config |
| Alerts tied to user-facing symptoms, not internal noise | T2 | Alert audit |
| Metrics dashboard: latency, error rate, saturation, traffic | T2 | Dashboard link |
| Incident process: severity levels, runbooks, postmortems | T2 | Last postmortem |
| Distributed tracing where architecture warrants | T3 | Trace sample |
Pillar 4 — Performance & Scalability (10%)
| Item | Tier | Evidence |
|---|
| Load test at 3–5× expected launch peak; know your breaking point | T1 | Test report |
| Core Web Vitals green on key pages (landing, signup, checkout) | T1 | Lighthouse / CrUX |
| DB indexed for hot queries; no N+1 on hot paths | T1 | Query analysis |
| CDN / static asset caching | T1 | Config |
| Rate limiting on auth, API and checkout endpoints | T1 | Test |
| Horizontal scaling path documented and tested | T2 | Scale test |
| Capacity planning reviewed quarterly | T3 | Doc |
Pillar 5 — Billing & Subscription Infrastructure (15%)
The pillar where most subscription launches quietly fail.
| Item | Tier | Evidence |
|---|
| Billing via Stripe / Paddle / Chargebee — never custom-built | T1 | Integration |
| Every webhook handled: created, payment succeeded/failed, canceled, plan changed | T1 | Test-mode event log |
| Webhook handlers idempotent — replay every event and verify state | T1 | Replay test |
| Full lifecycle tested: trial → convert, upgrade, downgrade (proration), cancel, resubscribe | T1 | Test matrix |
| Entitlements enforced server-side; plan change reflects in access within seconds | T1 | Negative test |
| Tax handling for actual sales jurisdictions (Stripe Tax / Paddle MoR) | T1 | Config |
| Dunning: retries, pre-expiration card reminders, update-payment prompts | T2 | Flow screenshots |
| Grace periods + involuntary-churn recovery flow | T2 | Config |
| Billing state reconciliation job — your DB vs. processor truth | T2 | Job output |
| Revenue recognition / accounting export | T3 | Report |
Pillar 6 — Pricing & Packaging (10%)
Research-backed pricing correlates with a 65% higher chance of hitting first-year revenue goals.
| Item | Tier | Evidence |
|---|
| Pricing tested with ≥ 20 real prospects — not gut feel | T1 | Interview notes |
| Anchored against named competitors | T1 | Comparison doc |
| Tier structure maps to a real value metric (seats, usage, features) | T1 | Packaging doc |
| Free trial or freemium decision made deliberately, with a conversion hypothesis | T1 | Doc |
| Annual/monthly mix with discount rationale | T2 | Pricing page |
| Price experimentation mechanism, incl. grandfathering plan | T3 | Policy |
Pillar 7 — Conversion Funnel & Growth (10%)
Being able to bill is not the same as being able to sell.
| Item | Tier | Evidence |
|---|
| Landing page states problem, outcome and price; loads fast | T1 | Page + vitals |
| Signup → activation flow instrumented end-to-end | T1 | Funnel dashboard |
| Defined activation moment and time-to-value target | T1 | Metric definition |
| Onboarding drives to activation: checklist, empty states, sample data | T1 | Walkthrough |
| Checkout friction audit: steps counted, guest info minimal, failures handled gracefully | T1 | Audit |
| Funnel conversion baselines set; weekly review | T2 | Dashboard |
| Lifecycle email: welcome, trial-ending, win-back | T2 | Sequences |
Pillar 8 — Retention & Revenue Health (5%)
| Item | Tier | Evidence |
|---|
| MRR, ARR, churn, LTV:CAC tracked from day one | T1 | Dashboard |
| Voluntary vs. involuntary churn separated — involuntary is fixable via Pillar 5 | T2 | Report |
| At-risk signals defined: login decline, feature-usage drop, support spikes | T2 | Alert definition |
| Cancellation flow captures reason + offers alternatives (pause, downgrade) | T2 | Flow |
| NRR tracked; expansion revenue path exists | T3 | Report |
Pillar 9 — Legal & Trust (5%)
| Item | Tier | Evidence |
|---|
| ToS + Privacy Policy reviewed against your actual data practices | T1 | Docs |
| Refund/cancellation policy published; cancel is as easy as signup (click-to-cancel) | T1 | Flow test |
| GDPR/CCPA basics: consent, data export, deletion on request | T1 | Process |
| PCI scope minimized — processor-hosted fields; card data never touches your servers | T1 | Architecture |
| DPA available for business customers | T2 | Template |
This framework is not legal advice — have counsel review your policies.
Pillar 10 — Support & Customer Success (5%)
| Item | Tier | Evidence |
|---|
| Support channel with committed response time; billing questions routed fastest | T1 | Policy |
| Docs/FAQ covering the top 10 predicted questions, including billing | T1 | Docs |
| Status page or incident comms plan | T2 | Page |
| Feedback loop from support → product backlog | T2 | Process |
Worked example (T1 SaaS, pre-launch)
| Pillar | Score | Weighted |
|---|
| Reliability | 7 | 1.05 |
| Security | 7 | 1.05 |
| Observability | 6 | 0.60 |
| Performance | 6 | 0.60 |
| Billing | 8 | 1.20 |
| Pricing | 5 | 0.50 |
| Funnel | 6 | 0.60 |
| Retention | 6 | 0.30 |
| Legal | 7 | 0.35 |
| Support | 6 | 0.30 |
| Composite | | 6.55 |
Gate check: all pillars ≥ 6 ✓; Security, Billing and Legal ≥ 7 ✓ → cleared for T1 launch, with Pricing (5) flagged as an exception: “run 20 prospect interviews within 30 days, owner: founder.”
Cadence
Re-run the audit at launch, at each architecture change, at each pricing change, after any Sev-1 incident, and quarterly. Automate whatever can be checked in CI — security scans, webhook replay tests, restore drills.
Sources
Google SRE — Production Readiness Review ·
Cortex — Production Readiness Checklist ·
OpsLevel — Production Readiness In Depth ·
DesignRevision — SaaS Launch Checklist ·
Stripe — SaaS Subscriptions Guide ·
Chargebee — Dunning Management ·
Baremetrics — SaaS Metrics Checklist
Audit runs against this framework
Dated, immutable runs — a re-audit gets a new date rather than overwriting the old one.
/framework/<project> always redirects to that project's latest.
All frameworks and audit runs →