Service Level Agreement (SLA) Template

SERVICE LEVEL AGREEMENT

Between

(collectively, the "Parties"; each a "Party")

Effective Date: [EFFECTIVE DATE] | Term: [INITIAL TERM, e.g., 12 months] | Auto-renewal: [YES/NO, period]

1. Purpose & Scope

• This SLA defines the service levels, performance metrics, responsibilities, and remedies for the Services described in the Service Agreement and Annex A (Service Definitions).
• Applies to: [LIST SPECIFIC SERVICES, e.g., Web App Hosting, SEO Platform, Shopify Store, AI API, Ad Management Dashboard, Expert Portal].
• Exclusions: Customer applications/code, third-party platforms (Shopify, Google, Meta, etc.), Customer premise equipment, force majeure events (Section 14).
• In case of conflict: Service Agreement > This SLA > Annexes.

2. Service Availability (Uptime)

2.1 Availability Targets

2.2 Exclusions from Downtime

• Scheduled maintenance (notified ≥ 72 hours, max 4 hrs/month, off-peak: Fri 02:00–06:00 GST)
• Force majeure (Section 14)
• Customer-caused issues (misconfiguration, credential expiry, quota exceeded)
• Third-party platform outages (Shopify, Google, Meta, OpenAI, cloud provider beyond Provider's control)
• DNS propagation, ISP issues, Client-side network

2.3 Service Credits for Availability Breach

Credits: Requested in writing within 15 days of month-end. Applied as invoice credit. Not refundable. Sole remedy for availability breaches.

3. Response & Resolution Times (Support)

3.1 Incident Priority Definitions

3.2 Response & Resolution Targets (Business Hours: Mon–Thu, Sun 09:00–18:00 GST; Fri 09:00–12:00)

3.3 After-Hours Support (Optional Add-On)

• 24/7 P1-only coverage: +25% of monthly fee. P1 response: 30 min. On-call rotation.
• Emergency hotline: +971 4 200 0000 (option 9) / WhatsApp priority queue.

3.4 Service Credits for Missed Resolution Targets

Max 20% monthly fee across all credits. Credits requested within 15 days.

4. Performance Metrics (Beyond Availability)

5. Monitoring, Reporting & Reviews

5.1 Monitoring

• Provider maintains 24/7 monitoring: infrastructure (CloudWatch/Datadog), application (APM), synthetic (Pingdom/Checkly), security (WAF/SIEM).
• Customer receives read-only access to status dashboard: status.cyberspeedllc.com (or Customer-specific).

5.2 Reporting

6. Change Management

• All changes to production follow ITIL-aligned Change Advisory Board (CAB) process.
• Standard Changes (pre-approved, low risk): Deployed any time per runbook. No approval needed.
• Normal Changes: Submitted ≥ 5 business days, CAB approval, risk assessment, rollback plan.
• Emergency Changes (P1/P2 remediation): Authorised by Engineering Lead + Customer stakeholder (verbal/email), post-implementation review within 48h.
• Customer notified of Normal/Emergency changes affecting their Services.
• Maintenance windows: Fri 02:00–06:00 GST (max 4 hrs/month scheduled). Emergency windows as needed with 2h notice.

7. Security & Compliance

• Provider maintains ISO 27001-aligned ISMS (certification target Q4 2026).
• Annual penetration test (CREST-certified), quarterly vulnerability scans, monthly patching.
• Data residency: UAE (Azure UAE North / AWS ME / GCP Dubai). Subprocessor locations per DPA Annex C.
• Encryption: AES-256 at rest, TLS 1.3 in transit, customer-managed keys option.
• Access control: Zero-trust, MFA, RBAC, PAM, quarterly access reviews.
• Incident response: 24/7, 72h regulatory notification (UAE Data Office / DIFC Commissioner / ADGM Registrar).
• Compliance: UAE PDPL, DIFC DP Law, ADGM DP Regs, GDPR (where applicable), PCI DSS SAQ-A (if payment processing).

8. Data Protection & DPA

Personal Data processing governed by the Data Processing Agreement (DPA) executed between Parties. Provider acts as Processor; Customer as Controller. Key commitments:

• Processing only per Customer instructions (Service Agreement, DPA, ticketing system).
• Subprocessors per DPA Annex C (30-day notice for new subprocessors).
• Data Subject rights assistance (48h notification of direct requests).
• Breach notification: 24h to Customer, 72h to supervisory authority.
• Return/deletion of Personal Data within 30 days post-termination.

9. Customer Responsibilities

• Provide timely access, credentials, approvals, and stakeholder availability.
• Maintain accurate contact/esculation info (Annex C).
• Use Services per Acceptable Use Policy (no illegal, abusive, excessive automated traffic).
• Maintain backups of Customer data outside Provider systems (Provider not liable for Customer-deleted data).
• Comply with third-party platform terms (Shopify, Google, Meta, OpenAI, etc.).
• Report suspected security incidents immediately.
• Pay invoices per payment terms (Net 14).

10. Service Credits — General Terms

• Credits are sole and exclusive remedy for SLA breaches.
• Customer must request in writing within 15 business days of month-end.
• Credits applied as invoice offset (next billing cycle). Not refundable, not transferable.
• Max aggregate credits per month: 30% of monthly recurring fee.
• Credits not payable if breach caused by Customer, force majeure, or excluded events.

11. Term & Termination

• SLA term aligns with Service Agreement.
• Either Party may terminate SLA with 30 days' written notice for material breach uncured after 15 days.
• Provider may suspend Services for non-payment (>15 days overdue) with 5 days' notice.
• On termination: Provider assists transition (30 days, billable at T&M rates). Data returned per DPA.

12. Continuous Improvement & SLA Updates

• SLA reviewed at each QBR. Proposed changes documented, agreed in writing.
• Provider may improve targets unilaterally (e.g., 99.9% → 99.95%) with 30 days' notice.
• Degradation of targets requires Customer written consent.
• Change Control Process (Service Agreement) governs scope/architecture changes affecting SLA.

13. Limitation of Liability

• Provider's total liability for SLA breaches capped at service credits per Section 10.
• Neither Party liable for indirect, consequential, punitive, or special damages (lost profits, data, business opportunity).
• Provider not liable for: third-party platform actions, Customer code/content, force majeure, regulatory changes.
• Service Agreement limitation of liability clause applies to this SLA.

14. Force Majeure

Neither Party liable for failure/delay due to events beyond reasonable control: natural disasters, war, terrorism, civil unrest, government actions, pandemics, internet infrastructure failures, cloud provider outages, third-party platform changes, strikes. Affected Party notifies promptly; obligations suspended during event. If > 30 consecutive days, non-affected Party may terminate without liability.

15. Governing Law & Dispute Resolution

• Governing Law: Laws of the United Arab Emirates and Emirate of Dubai.
• Disputes: Good-faith negotiation (15 days) → Mediation (DIAC Mediation Rules) → Arbitration (DIAC Arbitration Rules, Dubai seat, English language, single arbitrator).
• If Customer is DIFC entity: DIFC Courts, DIFC Law.
• If Customer is ADGM entity: ADGM Courts, ADGM Regulations.
• Injunctive relief: Dubai Courts (or DIFC/ADGM Courts as applicable) for interim measures.

16. General

• Entire Agreement: Service Agreement + SLA + Annexes + DPA.
• Amendments: Written, signed by authorised representatives.
• Assignment: Neither Party without consent (not unreasonably withheld). Permitted: affiliate, successor, acquirer (with notice).
• Notices: Email to designated contacts + courier to registered addresses. Deemed received: email (on send), courier (on delivery).
• Waiver: No waiver unless written. Failure to enforce ≠ waiver.
• Severability: Invalid provision severed; remainder enforceable.
• No Third-Party Beneficiaries: Except supervisory authorities (DPA).
• Language: English governing. Arabic translation for reference only.

SIGNATURES

ANNEX A — SERVICE DEFINITIONS

Complete per engagement. Defines scope, boundaries, and dependencies.

ANNEX B — MONITORING & REPORTING SPECIFICATIONS

B.1 Monitoring Stack

• Infrastructure: CloudWatch / Azure Monitor / GCP Operations Suite + Datadog
• Application: Datadog APM / New Relic / OpenTelemetry
• Synthetic: Checkly / Pingdom (5-min intervals, 3 regions: Dubai, Frankfurt, Singapore)
• Logs: Centralised (Datadog Logs / Loki / CloudWatch Logs) — 90-day hot, 1-year cold
• Security: Cloudflare WAF logs, SIEM (Datadog Security / Sentinel)

B.2 Alerting Thresholds

B.3 Status Page

• Public: status.cyberspeedllc.com (or Customer-branded)
• Components: API, Database, Cache, CDN, AI Inference, Integrations
• Incident communication: Acknowledgment ≤ 15 min (P1), Updates ≤ 30 min (P1), Resolution post within 1 hr

ANNEX C — ESCALATION MATRIX

Complete with Customer contacts. Provider contacts listed below.

C.1 Escalation Paths

1. P1: On-Call Eng → (15 min) Eng Lead → (30 min) CTO → (1 hr) Customer Primary → (2 hr) Customer Exec
2. P2: Team Lead → (1 hr) Eng Lead → (4 hr) Customer Primary → (8 hr) Customer Tech Lead
3. P3/P4: Support Desk → (SLA) Team Lead → Customer Primary
4. Security Incident: DPO (Provider) ↔ DPO (Customer) direct, parallel to P1 path. Legal/Compliance notified.

Contact for SLA Matters