Struck in red is what Ashby removed; blue is what they added. Muted text is unchanged context.
BeforeAfter
ChangedStatus#1
Before: resolved
After: postmortem
AddedUpdatepostmortem#2
Before: not present
After: Summary
For approximately 43 minutes, some applicants were unable to submit applications on Ashby-hosted job boards. The issue lasted from 11:29 PM UTC on October 14 to 12:12 AM UTC on October 15.
Why did this happen?
Ashby uses an upstream provider to power bot-detection for job applications, helping prevent automated spam submissions on our job boards. Our billing account with this service was tied to another product we used with the upstream provider. When we sunset our use of that other product, the billing account was also removed from our bot-detection service, triggering a usage limit that prevented some checks from completing.
At the time, Ashby required these checks to be completed before accepting an application. As a result, affected submissions were blocked, and the applications were not created in Ashby.
How did we resolve the situation?
On October 14, 2026, at 11:29 PM UTC, a member of our team worked with our upstream provider’s support to sunset usage of a different product; the changes they made affected the billing for our bot-detection service, and application submissions began failing.
At 11:42 PM UTC, our team identified errors from the bot-detection service and began investigating.
At 11:59 PM UTC, we restored billing for the service, allowing it to process requests beyond the usage limit. Error rates began declining as the change took effect.
On October 15, at approximately 12:12 AM UTC, the final error associated with this incident was recorded. We continued monitoring, did not observe further errors of this kind, and resolved the incident.
What have we put in place to prevent it from happening in the future?
We have implemented changes both to reduce the likelihood of another billing issue and to prevent a temporary failure of the third-party service from blocking applications:
We corrected our billing setup and disconnected it from other products with the upstream provider.
We changed how Ashby handles errors from the upstream provider’s service. Applications now go through even if the service is temporarily unavailable. If this were to happen again, we would prefer to let all applications through to ensure valid candidates make it into the system, since we can always clean up spam applications retroactively.
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.