A Cribl Certified App meets Cribl’s standards for compatibility, performance, reliability, security remediation, and developer support. A Cribl Certified App is ready for business-critical use, and the Cribl Marketplace marks it with a Cribl Certified badge.

You request certification once for an App, after it is listed. Certification applies to the App, so each new version that Cribl approves for listing is certified as well. Cribl can remove certification if the App stops meeting these requirements. Before you pursue certification, publish the App in the Cribl Marketplace.

Support Baselines ​

As the publisher of a Certified App, provide a contact method and a link to a ticketing system so that you can:

• Monitor reported issues and respond within the applicable support baseline.
• Provide fixes within the required remediation windows for security-related bugs.
• Address critical- and high-severity functionality bugs.
• Keep Cribl informed when an issue requires additional investigation or remediation time.
• Respond to critical customer support issues within 24 hours, five days a week, during your local business hours.

If an App falls outside the applicable service-level agreement (SLA), Cribl sends a warning email. If the issue remains unaddressed after two more follow-ups, Cribl can remove the App’s certification.

Security Remediation SLAs ​

For security-related bugs in a Cribl Certified App, meet these remediation deadlines. Critical and High windows also apply to any App listed in the Cribl Marketplace. Certified Apps add Medium and Low windows:

The remediation clock applies to delivering the fix, not only acknowledging or triaging the issue. Remediate newly discovered vulnerabilities within these deadlines to avoid having the App delisted.

Data Expectations ​

A Certified App must collect, process, and retain only the customer data necessary to provide its documented functionality.

• Keep customer data within the App’s intended processing boundary and the approved Cribl services or destinations that the App requires.
• Do not extract, copy, export, or transmit customer data outside the App for unrelated analytics, debugging, development, marketing, model training, or another secondary purpose.
• Do not send customer data to developer-controlled systems, personal storage, test environments, or third-party services unless the App requires the destination. Document and approve the destination through the applicable configuration and review process.

For the Apps data and credential boundaries, see Runtime, Architecture, and Security.

Responsible Use of AI ​

If an App uses an AI or machine learning service, use that service safely, transparently, and only for the App’s documented purpose.

• Document the AI provider, model, or service. Include its purpose, data inputs, outputs, retention behavior, processing location, and any subprocessors that handle customer data.
• Send only the minimum data required for the AI feature. Redact credentials, secrets, unnecessary identifiers, and unrelated customer content before submission.
• Do not send raw customer data to an AI service for model training, evaluation, or product improvement unless the customer explicitly authorizes that use and you clearly disclose it.
• Use approved, declared integrations for AI services. Route external calls through the App’s approved proxy configuration, and restrict hosts, paths, headers, and methods to what the App requires.

For how Apps handle external AI services, see Third-Party Services and AI.

Certification Checklist ​

Before you request certification, validate the following areas.

Upgrade Compatibility ​

• Test upgrades across older App versions.
• Preserve expected behavior and supported upgrade paths in the new version.

Backend Functions ​

If the App uses backend functions, make sure that the functions are appropriately sized, bounded, observable, and limited to the capabilities they need.

Right-Size Compute Allocation ​

• Declare endpoint-specific memory and timeout values in config/backend.yml based on representative workload measurements. Do not use the maximum values by default.
• Keep the p95 execution duration at or below 80 percent of the declared timeout and peak memory usage at or below 80 percent of the declared memory allocation. Document and justify exceptions.
• Test normal and peak workloads, including invocation frequency, concurrent requests, scheduled jobs per run, payload size, execution duration, and memory usage.
• Bound pagination, batch sizes, fan-out, and concurrency. Make sure that every invocation can finish within its declared timeout.

For configuration details, see Backend Functions in the Builder Guide.

Enforce Least Privilege ​

• Declare every Cribl API route and HTTP method that the frontend or a backend function requires in config/policies.yml.
• Request the narrowest route and method set that satisfies the App’s behavior. Avoid broad resource wildcards unless they are necessary and documented.
• Remove unused grants, and update config/policies.yml whenever a new function or workflow introduces an API call.

For policy guidance, see Declare In-Product API Permissions Your App Needs in the Builder Guide.

Request Certification ​

After your App is listed, request certification. Certification is separate from publication, so an App can be listed without being certified.

To request certification:

1. Sign in to the Cribl Marketplace.
2. On your listed App, select Configure.
3. Select Request Certification.

The App shows Under Certification until Cribl decides. Request Certification is available on a listed App that is not certified and has no open request.

Cribl emails you when the request is accepted or rejected. A rejection email includes the reason. After a rejection, the App stays listed, and you can request certification again.

New Versions ​

You do not request certification again for a new version. On your listed App, select Configure, then Publish new version, and confirm that the version still meets the Certification Checklist.

When Cribl approves the new version for listing, the new version is certified if the App was certified. If a certification request is open, it continues for the new version. If Cribl does not approve the new version, it is not published, and the previous listed version remains available.

Retain Certification ​

To retain certification for your App, continue to meet the applicable SLA requirements.

When someone reports the current version, Cribl reviews the report and can:

• Remove the App from the Cribl Marketplace.
• Remove the App’s certification.
• Reject the report and leave the listing unchanged.