Web SDK Outage (all regions)

### Summary

On 1 September 2026, from 13:21 UTC to 13:45 UTC, users attempting document capture in the Web SDK were unable to finish their session. This also extended to native Entrust IDV SDK’s for configurations that contain web modules. Native Onfido Android and iOS SDKs were unaffected.

### Root Causes

A routine update to a container image for our document configuration service introduced a regression to the synchronization job that updates the documents list. This resulted in the endpoint that our SDKs use to fetch documents returning `500` errors. This prevented web SDK flows from proceeding. Our native SDKs use a backup document list which allowed them to continue as normal.

Our progressive roll-outs are designed to catch service faults before they become significant. However, the synchronization job failure did not mark the readiness probe as unhealthy, so the rollout continued.

### Timeline

_13:10 UTC:_ We started a progressive rollout of the change.
_13:21 UTC_: The service was fully rolled out leading to errors on impacted SDK functionality.
_13:26 UTC:_ Monitoring alerted the team.
_13:44 UTC:_ Cause identified and change rolled back.
_13:45 UTC:_ Service restored.

### Remedies

* We will add missing automated testing coverage to ensure that we catch these cases in the future.
* We will add a fallback document list to the Web SDK, similar to the mechanism present in the native SDKs, to ensure it can still function in the case of any similar future failures.
* We will fix the progressive rollout to ensure that the rollout will not continue in the case that something has gone wrong with synchronizing documents.

From approximately 1:21 PM UTC to 1:46 PM UTC, there was a disruption to accepting Document requests from the Web SDK as well as Entrust IDV SDKs for flows containing web modules.

Onfido Android & iOS SDKs were not impacted.

We apologize for this disruption. A detailed postmortem will follow once we've concluded our investigation.