SERVICE LEVEL AGREEMENT
Important legal-advice, jurisdiction and formality warning
This fictional agreement is a complete worked example, not legal advice and not a universal service promise. It is written for a cloud software provider and a business customer operating in England and Wales. The parties must check the main services agreement, data-processing terms, sector regulation, cybersecurity requirements, consumer status, tax treatment and the enforceability of every remedy before signing. A service credit is not automatically a complete remedy, and a target in this document is not a guarantee that a service will be uninterrupted. This agreement should be reviewed by a suitably qualified adviser and signed by authorised representatives in the required form.
1. Parties, date and purpose
This Service Level Agreement is made on 4 March 2026 between Harbourlight Cloud Systems Limited, company number 15274018, whose registered office is at 14 Meridian Quay, Bristol BS1 6XL, the Provider, and Eastmere Housing Services Limited, company number 08931742, whose registered office is at 82 Linton Road, Birmingham B15 2JL, the Customer. The Provider operates the Harbourlight Resident Portal, a hosted application used by the Customer to manage repairs, appointments and resident communications. The Customer and Provider entered into a Subscription and Services Agreement dated 4 March 2026, under which the Provider supplies the production service for an initial term of three years.
This SLA applies to the production Resident Portal and its public application programming interface from 00:00 on 1 April 2026. It does not replace the Subscription and Services Agreement. If the documents conflict, this SLA controls only the measurement of service levels, support targets and service credits; the Subscription and Services Agreement controls liability, payment, intellectual property, confidentiality, data protection and termination.
2. Service hours and definitions
The production service is intended to be available 24 hours a day, every day. Business Hours means 08:00 to 18:00 Monday to Friday in England, excluding bank holidays. Availability means the percentage calculated by subtracting Eligible Downtime from the total minutes in a calendar month and dividing the result by total minutes in that month, multiplied by 100. Eligible Downtime expressly includes both (a) a complete inability to log in to the production service, measured by the Provider's external monitoring from three independent United Kingdom locations, and (b) a partial outage, measured by the proportion of active tenants unable to use the affected production function. A partial outage affecting fewer than 20 percent of active tenants is weighted at 50 percent of each affected minute; a partial outage affecting 20 percent or more is weighted at 100 percent of each affected minute.
Excluded Downtime consists of planned maintenance notified at least five business days in advance, emergency maintenance reasonably required to address a security risk, failure of the Customer's network or equipment, misuse or an unauthorised Customer change, a failure of a Customer-controlled integration, a third-party internet or telecommunications failure outside the Provider's control, and force majeure. Those exclusions are applied before the complete or weighted partial-outage calculation above. The Provider must not classify a Provider-caused outage as excluded merely because investigation is difficult.
3. Availability commitment and maintenance
The Provider will use reasonable skill and care to achieve a Monthly Uptime Percentage of at least 99.90 percent. In a 30-day month this permits 43.2 minutes of Eligible Downtime; in a 31-day month it permits 44.64 minutes. The Provider will publish a monthly availability report by the seventh business day of the following month, showing total minutes, excluded minutes, incidents, calculation and any credit due. If monitoring systems disagree, the parties will use the Provider's raw logs together with the independent monitoring records, and the Provider must explain any adjustment.
Routine maintenance will normally occur between 01:00 and 04:00 on a Sunday. The Provider will give the Customer at least five business days' notice, state the expected effect and use a tested rollback plan. Emergency maintenance may occur without that notice when delay would create a material security or availability risk, but the Provider will notify Priya Nand, the Customer's Head of Digital Services, as soon as reasonably practicable and will provide a post-maintenance account within two business days.
4. Incidents, response and restoration
The Customer may report an incident through support.harbourlight.example.test, by email to helpdesk@harbourlight.example.test, or, for a Critical Incident, by telephone on 0117 555 0196. The Customer should state its contact, time discovered, affected users, steps already taken and business impact. The Provider may reasonably reclassify a severity after discussing the reason with the Customer.
Severity 1 means a complete production outage, a confirmed loss of resident data, or a security incident creating an immediate material risk. The Provider will acknowledge within 15 minutes, provide updates every 30 minutes and restore the core service or provide a workable mitigation within four hours. Severity 2 means a material feature failure affecting more than 25 percent of users without a reasonable workaround; acknowledgement is within one hour, updates every two hours and restoration within eight business hours. Severity 3 means a limited degradation or a problem with a workaround; acknowledgement is within four business hours and a correction is targeted within five business days. Severity 4 means a question or minor defect; acknowledgement is within two business days and resolution is planned for a suitable release.
The clock starts when the Provider receives sufficient information and pauses only while the Provider is waiting for a requested Customer action or access. An incident is restored when the principal function is available, even if a permanent code correction remains subject to a later release. The Provider will give the Customer a root-cause report for every Severity 1 incident within ten business days, identifying chronology, impact, cause, remedial work and a named owner for preventive actions.
5. Disaster recovery, security and data
The Provider will maintain encrypted backups at least every six hours, retain daily backups for 35 days and test restoration quarterly. Its recovery point objective is six hours and its recovery time objective for a declared platform disaster is eight hours. These are operational targets, not insurance against loss. The Provider will restrict production access by role, require multi-factor authentication for administrators, encrypt data in transit and at rest, review privileged access quarterly and maintain an incident-response plan.
The Provider will notify the Customer's security contact, Marcus Ellery, at security@eastmere.example.test within 12 hours after confirming a security incident affecting Customer data. The notice will state known facts, containment measures and a contact for updates. Personal data processing remains governed by the Data Processing Addendum dated 4 March 2026; nothing in this SLA changes controller or processor responsibilities or the requirement to notify the Information Commissioner's Office where applicable.
6. Customer responsibilities and dependencies
The Customer will maintain supported browsers, secure its user credentials, appoint authorised contacts, make timely decisions and provide accurate information. It will not test the service destructively or make an unauthorised integration change. The Provider is not responsible for an outage caused solely by a Customer-controlled identity provider, an unsupported browser, a Customer script or a failure to provide access needed for diagnosis. The Provider remains responsible for its subcontractors and will ensure that material subcontractors are bound by obligations consistent with this SLA.
7. Credits, governance and chronic failure
If availability is below 99.90 percent but at least 99.50 percent, the Customer receives a credit equal to 5 percent of that month's recurring platform fee. From 99.00 percent to 99.49 percent the credit is 10 percent; below 99.00 percent the credit is 20 percent. The recurring platform fee is £18,000 per month, so the maximum monthly credit is £3,600. For April 2026, the report recorded 43 minutes of Eligible Downtime in 43,200 total minutes, producing availability of 99.90046 percent and no credit. A qualifying credit must be claimed within 30 days of the report and is applied to the next invoice; total credits cannot exceed 20 percent of the monthly platform fee.
The parties will hold an operational review each month and a quarterly service review attended by Leonie Hart, the Provider's Service Director, and Priya Nand. Three months in any rolling six-month period below 99.90 percent, or two Severity 1 incidents in one quarter caused by the Provider, is chronic service failure. The Customer may require a 30-day improvement plan. If the plan fails, the Customer may terminate the affected service on 30 days' notice, without losing accrued rights, and the Provider will supply 60 days of reasonable data-export and transition assistance at no additional charge.
8. Liability, disputes and general provisions
Credits are the agreed financial remedy for a measured availability failure, except for fraud, deliberate misconduct, a confidentiality breach, a data-protection breach, or a remedy that cannot lawfully be limited. The liability caps in the Subscription and Services Agreement apply. Neither party may suspend an undisputed service merely because the parties disagree about a credit. A disputed calculation will be escalated to the service directors, then to an independent technology accountant agreed within ten business days; an urgent court application remains available.
This SLA is governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction, subject to any mandatory rule that cannot be excluded. Notices must be delivered to the registered offices above or the named notice emails and are effective on confirmed receipt. Amendments must be written and signed by both parties. Electronic signatures and counterparts are permitted if legally effective. If one provision is invalid, the rest remains effective.
Execution
Signed for Harbourlight Cloud Systems Limited
Name: Elise Marlow, Chief Executive Officer Signature: ____________________ Date: 4 March 2026
Signed for Eastmere Housing Services Limited
Name: Jonathan Reed, Finance and Operations Director Signature: ____________________ Date: 4 March 2026