Service Level Availability, Production Support and Security Policy
20th July 2020
This Carriyo FZ-LLC (“CARRIYO” or “We”) Service Level Availability (“SLA”) is a policy governing the use of Service under the terms of the Terms of Service (“Agreement” or "Terms") between CARRIYO and the users of CARRIYO’s Services (“You” or “Client”). Unless otherwise provided herein, this SLA is subject to the terms of the Agreement and capitalized terms will have the meaning specified in the Agreement. We reserve the right to update this SLA from time to time upon notice to you.
CARRIYO will use commercially reasonable efforts to make the Service available with a Monthly Uptime Percentage (defined below) of at least 99%, during any billing cycle (the “Service Commitment”). In the event CARRIYO does not meet the Service Commitment, you will be eligible to receive a Service Credit as described below.
“Monthly Uptime Percentage” is calculated by subtracting from 100% the percentage of minutes during the month in which the Service was “Unavailable.” Monthly Uptime Percentage measurements exclude downtime resulting directly or indirectly from any CARRIYO Exclusion (defined below).
“Unavailable” and “Unavailability” mean that the CARRIYO Production Service is unavailable at the CARRIYO production data center’s internet connection points.
A “Service Credit” is a dollar credit, calculated as set forth below, that we may credit back to an eligible account.
SERVICE COMMITMENTS AND SERVICE CREDITS
Service Credits are calculated as a percentage of the total charges paid by you (excluding one-time payments such as for example, implementation fees) for the Service that was Unavailable, as applicable for the monthly billing cycle in which the Unavailability occurred in accordance with the schedule below.
Monthly Uptime Percentage and Applicable Service Credit Percentage
Less than 98.0% but equal to or greater than 95.0%: 10% Service Credit
Less than 95.0%: 30% Service Credit
We will apply any Service Credits only against future payments otherwise due from you. At our discretion, we may issue the Service Credit to the credit card and/or bank account you used to pay for the billing cycle in which the Unavailability occurred. Service Credits will not entitle you to any refund or other payment from CARRIYO. Unless otherwise provided in the Agreement, your sole and exclusive remedy for any Unavailability, non-performance, or other failure by us to provide Service is the receipt of a Service Credit (if eligible) in accordance with the terms of this SLA.
CREDIT REQUEST AND PAYMENT PROCEDURES
To receive a Service Credit, you must submit a claim to our authorized representative. To be eligible, the credit request must be received by us by the end of the second billing cycle after which the incident occurred and must include:
the words “SLA Credit Request” in the subject line;
the dates and times of each Unavailability incident that you are claiming;
the affected process or specific functionality; and
your request logs that document the errors and corroborate your claimed outage (any confidential or sensitive information in these logs should be removed or replaced with asterisks)
If the Monthly Uptime Percentage of such request is confirmed by us and is less than the Service Commitment, then we will issue the Service Credit to you within one billing cycle following the month in which your request is confirmed by us. Your failure to provide the request and other information as required above will disqualify you from receiving a Service Credit.
The Service Commitment does not apply to any unavailability, suspension or termination of the Service or performance issues: (i) caused by factors outside of our reasonable control, including any force majeure event or Internet access or related problems; (ii) that result from any actions or inactions of you or any third party; (iii) that result from your equipment, software or other technology and/or third party equipment, software or other technology; (iv) that result from any scheduled maintenance as provided in Section 6(a) herein; or (v) arising from our suspension and termination of your right to use the Services in accordance with the Terms of Service (collectively, the “CARRIYO Exclusions”). If availability is impacted by factors other than those used in our Monthly Uptime Percentage calculation, then we may issue a Service Credit considering such factors at our discretion.
PRODUCTION SUPPORT AND MAINTENANCE
CARRIYO’s Service is based on a multi-tenanted operating model that applies common, consistent management practices for Clients using this Service with the following policies regarding production support and maintenance:
i. Planned Maintenance
CARRIYO’s planned maintenance includes:
Four (4) hours for weekly maintenance
Four (4) hours for monthly maintenance
Four (4) hours for quarterly maintenance
ii. CARRIYO Update Process and Notifications
CARRIYO may enhance the capabilities of the Service with new features. Updates can take approximately six (6) hours to complete, which will require the Service to be taken down for some or all of that time. This will not be considered as an unplanned outage. CARRIYO will provide notification of and information about Updates well in advance.
iii. Disaster Recovery
CARRIYO maintains a disaster recovery plan for the Service towards i) a recovery time objective of twelve (12) hours measured from the time that the Service becomes unavailable from a disaster, until it is available again and ii) a recovery point objective of one (1) hour- measured from the time that the first transaction is lost until the Service became Unavailable.
iv. Support Request Submittal and Reporting
Client may submit support requests to CARRIYO via email addressed to firstname.lastname@example.org. Each support request will be assigned a unique number. CARRIYO will respond each case in accordance with this SLA and will use commercially reasonable efforts towards resolution of each issue consistent with the Agreement with timing dependent on the nature of the case and the resolution itself. A resolution may consist of a fix, workaround, or delivery of information.
v. Service Level Determination
The Client shall reasonably self-diagnose each support issue and recommend to CARRIYO an appropriate Severity Level designation as set forth herein. CARRIYO shall validate Client's Severity Level designation or notify Client of a proposed change in the Severity Level designation to a higher or lower level with justification for the change. In the event of a conflict regarding the appropriate Severity Level designation, each party shall promptly escalate such conflict to its management team for resolution through consultation between the parties' management, during which time the parties shall continue to handle the support issue in accordance with the CARRIYO Severity Level designation.
vi. Support Request – Severity Levels and Response Time
Response time is the period from the time the Support Request was reported to CARRIYO until CARRIYO responds to Client and the parties recognize that CARRIYO will use commercially reasonable efforts in its response and any resolution timing is dependent on the nature of the reported issue, in each case as follows and subject to Client’s Commitment:
vii. Support Tiers and Support Availability
CARRIYO supports two tiers of support as portrayed in the table below.
CARRIYO SUPPORT SCOPE
CARRIYO will support functionality that is developed by CARRIYO and under its direct control. For all other functionality, and/or issues or errors in the Service caused by issues, errors and/or changes in Client's information systems and/or third-party products or services including CARRIYO Exclusions if applicable, CARRIYO may assist Client and its third-party providers in diagnosing and resolving issues or errors but Client acknowledges that these matters are outside of CARRIYO's support obligations and shall be subject to the express prior written consent of the parties.
CARRIYO Service includes the following administrative, technical and physical steps towards safeguards to protect Client Data from loss, damage, alteration, destruction, and unauthorized access or use:
Policies, procedures, and logical controls:
To limit access to its information systems and the facility or facilities in which they are housed to properly authorized persons;
To prevent those workforce members and others who should not have access from obtaining access; and
To remove access in a timely basis in the event of a change in job responsibilities or job status.
ii.Physical and Environmental Security
No CARRIYO employee has access to the applicable physical environments. CARRIYO uses a 3rd party Cloud Service.
CARRIYO will hold Client data for the last 12 months in its operational data store, periodically archiving older data.
In order to respond to an emergency or other occurrence that could damage Client Data or production systems that contain Client Data, CARRIYO implements a policy for performing periodic, automatic backups of production file systems and databases according to a defined schedule.
v.Audit Controls and Monitoring
Procedural mechanisms that record and examine activity in information systems that contain or use electronic information, including appropriate logs and reports concerning these security requirements.
CARRIYO Service includes policies and procedures towards protecting the confidentiality, integrity, and availability of Client Data against disclosure, improper alteration, or destruction.