Service Level Agreement
Effective: 2026-05-15
This Service Level Agreement ("SLA") is part of our standard Master Services Agreement. It applies to the production Service (the API at https://api.complianceassessmenttool.com, the iframe portal at /portal/embed, and the MCP server at /mcp).
1. Uptime target
We strive for 99.5% Monthly Uptime Percentage for the production Service during each calendar month. This is an aspirational target rather than a contractually guaranteed level: we do not offer service credits for falling below it. We commit instead to transparency — communicating known issues quickly and publishing post-incident reviews after any extended outage.
2. How "uptime" is measured
"Monthly Uptime Percentage" for a given calendar month is:
(Total minutes in month − Downtime minutes) ÷ Total minutes in month × 100
"Downtime" means a period of at least five (5) consecutive minutes during which the Service returns HTTP 5xx errors or fails to respond to a synthetic health-check probe at the rate of more than 50% across two consecutive minutes, as measured by our monitoring against the canonical /health endpoint.
3. What we exclude from "downtime"
- Scheduled maintenance announced at least 48 hours in advance (limit: 4 hours/month, performed during 02:00–06:00 UTC).
- Force majeure events (natural disaster, war, terrorism, government action, internet backbone failure).
- Customer-caused issues (exceeding documented payload limits, calling deprecated endpoints, misconfigured webhook URLs).
- Failure of an upstream sub-processor (AWS, OpenAI) for which we have invoked a documented mitigation. AWS Service Health Dashboard and OpenAI status are the references.
4. Support response times
| Severity | Definition | Initial response |
|---|---|---|
| P1 (Critical) | Production Service is unavailable or returns errors for more than 50% of requests across all Partners | 30 minutes, 24×7 |
| P2 (High) | A core function (SAQ generation, signing, finalization) is impaired for a Partner; no workaround | 4 business hours |
| P3 (Normal) | Non-critical bug; functional workaround available | 1 business day |
| P4 (Low) | Question, feature request, documentation issue | 3 business days |
"Business hours" are 09:00–18:00 US Pacific Time, Monday through Friday, excluding US federal holidays. Submit tickets to chris.larson@complianceassessmenttool.com with the severity and a reproduction case.
5. Incident communication
During a P1 incident we update affected Partners directly (via the contact on file) at least every 30 minutes until the incident is resolved. After resolution we share a written summary of root cause and remediation within 5 business days.