Service level agreement

1. Definitions

"Service" means the production hosting of a client's site or application under a plan. "Downtime" means a period during which the Service returns errors or no response to our external monitoring from a majority of monitoring regions for at least two consecutive checks. "Monthly uptime" is the minutes in a calendar month minus Downtime minutes, divided by the minutes in the month, excluding the periods in section 7. "Business hours" are 09:00 to 18:00 UTC, Monday to Friday, excluding public holidays we publish in advance.

2. Uptime commitment

Plan	Monthly uptime commitment	Maximum Downtime per month
Foundation	99.9%	about 43 minutes
Assured	99.9%	about 43 minutes
Sovereign	99.99%	about 4 minutes

The Sovereign commitment is possible because Sovereign runs on a load-balanced, multi-node architecture with a tested failover. Foundation and Assured run on single nodes behind a CDN, which is why their commitment is 99.9%.

3. How uptime is measured

We measure from outside, using HTTP checks of the production hostname every 60 seconds (30 seconds on Sovereign) from three regions on Foundation and six regions on Assured and Sovereign. A check passes if the hostname returns an expected status code within 10 seconds. Downtime is recorded when checks fail from a majority of regions twice in a row, and ends when a majority pass. Monitoring data is retained for at least 13 months and the monthly figure is included in your report. If you measure differently and disagree with our figure, we will look at both sets of data together.

4. Support response and resolution

Severity levels.

• Severity 1, outage: the production Service is down or unusable for most users, or there is an active security incident.
• Severity 2, degraded: a major function (checkout, login, forms, email) is failing, or performance is severely degraded.
• Severity 3, impaired: a non-critical function is failing or a workaround exists.
• Severity 4, request: a question, a change request, or scheduled work.

Target	Foundation	Assured	Sovereign
Sev 1 response	4 business hours	1 hour, 08:00–20:00 UTC daily	15 minutes, 24/7
Sev 1 work continues until resolved	Business hours	08:00–20:00 UTC daily	24/7
Sev 2 response	Next business day	4 hours, 08:00–20:00 UTC	1 hour, 24/7
Sev 3 response	2 business days	1 business day	4 business hours
Sev 4 response	2 business days	1 business day	1 business day
Channels	Email	Email, shared channel	Email, shared channel, phone, on-call

"Response" means an engineer has acknowledged the issue, assigned a severity and started work, not an automated receipt. Our monitoring opens Severity 1 incidents automatically; you do not need to report an outage for the clock to start. Resolution times are not guaranteed because root causes vary, but Severity 1 work continues within the hours stated until the Service is restored, and you receive updates at least hourly during a Severity 1 incident.

5. Backup and recovery objectives

Objective	Foundation	Assured	Sovereign
Backup frequency	Daily	Hourly	Continuous (point-in-time for databases), hourly for files
Retention	14 days	30 days	90 days
Recovery point objective (maximum data loss)	24 hours	1 hour	5 minutes for databases, 1 hour for files
Recovery time objective (restore of a site from backup)	8 business hours	4 hours	1 hour, or automatic failover for node failure
Restore drill	Quarterly	Monthly	Monthly, plus failover test quarterly

6. Maintenance

Routine maintenance that may cause Downtime is scheduled outside your business's peak hours, announced at least 48 hours in advance by email and on the status page where enabled, and limited to four hours per month. Emergency security maintenance may be performed with shorter notice when a vulnerability is being actively exploited; we tell you as soon as practical. Announced maintenance within these limits is excluded from Downtime; maintenance that overruns the announced window is not.

7. Exclusions

The following are not counted as Downtime and do not earn credits:

• Announced maintenance within the limits in section 6.
• Failures caused by your actions or those of your users or third parties you engage, including code or content you deploy outside our pipeline, DNS changes made without us, or credentials you share.
• Failures of third-party platforms we do not host, such as a hosted commerce platform, a payment gateway, an email provider or an advertising platform, although we will treat them as incidents and help you through them.
• Suspension under the acceptable-use or non-payment provisions of the terms.
• DNS propagation delays after a change you requested.
• Events beyond our reasonable control, such as widespread internet outages, provider-wide failures affecting multiple regions, or force majeure, provided we have followed our own recovery procedures.
• Staging, preview and development environments.

8. Service credits

If monthly uptime falls below the commitment, you receive a credit of a percentage of that month's plan fee:

Foundation and Assured (99.9%)	Sovereign (99.99%)	Credit
Below 99.9% but at least 99.0%	Below 99.99% but at least 99.9%	10%
Below 99.0% but at least 95.0%	Below 99.9% but at least 99.0%	25%
Below 95.0%	Below 99.0%	50%

If we miss a Severity 1 response target, you receive an additional 5% credit for that month. Credits in any month are capped at 50% of that month's plan fee, are applied to your next invoice, and are refunded in cash if the plan is ending. Credits are the sole remedy for SLA failures, as set out in the terms. They do not apply to pass-through costs.

9. Claiming a credit

We apply uptime credits automatically when our monitoring shows the commitment was missed; you will see the credit on your invoice and the reason in your report. If you believe a credit is due and it has not been applied, email contact@innovationsgrc.com within 30 days of the end of the month in question with the dates and times you observed. We respond within five business days with our monitoring data and a decision.

10. Reporting

Every plan receives a monthly report containing the measured uptime, any Downtime incidents with cause and remediation, response times for support requests, backup and restore results, security events and changes made. Assured and Sovereign clients also receive a review call. The report is the record against which this SLA is assessed.