Service Level Agreement (SLA)

This Service Level Agreement ("SLA") sets out the availability commitments, support response times, and remedies for PrivyNet's Infrastructure-as-a-Service (IaaS) offerings.

Covered Services:

This SLA applies to the following PrivyNet services:

• VPN Data Plane: The VPN gateway infrastructure that handles customer VPN connections and traffic.

• Dedicated VPN Infrastructure: Private VPN servers provisioned exclusively for individual customers.

• Management API: The API endpoints used to manage VPN configurations, users, and settings.

• Customer Dashboard: The web-based management portal for account and service administration.

Not Covered by This SLA:

• Beta or preview features (provided "as is" without availability commitments).

• Free trial accounts (SLA applies only to paid services).

• Third-party integrations or services not operated by PrivyNet.

• Customer-side software, clients, or applications.

This SLA forms part of your agreement with PrivyNet and should be read together with our Terms of Service, Acceptable Use Policy, and Privacy Policy. In the event of conflict, the order of precedence set out in the Terms of Service applies.

For the purposes of this SLA, the following definitions apply:

• "Availability" or "Uptime": The percentage of time during a calendar month that the Covered Services are operational and accessible, as measured by PrivyNet's monitoring systems.

• "Downtime": A period during which a Covered Service is Unavailable, measured from the time the outage is detected or reported until service is restored.

• "Unavailable" / "Unavailability": A Covered Service is considered Unavailable when:

- VPN Data Plane: Customers are unable to establish new VPN connections, or more than 50% of established connections are dropped, for 5 or more consecutive minutes.

- Management API: The API health endpoint returns errors or fails to respond for 5 or more consecutive minutes.

- Customer Dashboard: The dashboard is inaccessible or returns errors for 5 or more consecutive minutes.

• "Monthly Uptime Percentage": Calculated as: ((Total Minutes in Month - Downtime Minutes) / Total Minutes in Month) × 100.

• "Scheduled Maintenance": Planned maintenance activities for which advance notice has been provided in accordance with Section 4.

• "Emergency Maintenance": Unplanned maintenance required to address security vulnerabilities, imminent failures, or other urgent issues.

• "Service Credit": A credit applied to your account as compensation for Downtime, calculated as described in Section 8.

• "Service Fees": The fees invoiced for your service plan, calculated based on consumption thresholds and monthly billing cycles, excluding one-time fees and taxes.

PrivyNet commits to the following Monthly Uptime Percentages for Covered Services:

Service Availability Targets:

| Service Component | Monthly Uptime Target |

|--------------------------|----------------------|

| VPN Data Plane | 99.9% |

| Dedicated Infrastructure | 99.9% |

| Management API | 99.5% |

| Customer Dashboard | 99.5% |

How We Measure Availability:

• Availability is measured using PrivyNet's internal monitoring systems, which poll service health endpoints at 1-minute intervals from multiple geographic locations.

• Downtime begins when our monitoring detects an outage or when a customer reports an outage that we confirm, whichever is earlier.

• Downtime ends when the service is restored and confirmed operational by our monitoring systems.

Availability Calculation:

• Availability is calculated per calendar month (UTC timezone).

• Partial months (e.g., if you sign up mid-month) are prorated based on the days of active service.

What Counts as Downtime:

• Complete service outages affecting all customers.

• Partial outages affecting a significant portion of customers (more than 25%) or a specific region.

• Degraded performance where the service is technically reachable but functionally unusable (e.g., connection timeouts, >90% packet loss).

What Does NOT Count as Downtime:

• Scheduled Maintenance (see Section 4).

• Exclusions listed in Section 7.

• Brief interruptions of less than 5 consecutive minutes.

• Issues affecting individual customers due to their own configuration or connectivity.

We perform regular maintenance to ensure the security, reliability, and performance of our services. We aim to minimise customer impact through careful planning and rolling update procedures.

Rolling Update Approach:

• We typically perform maintenance using rolling updates: deploying updated nodes, draining traffic from old nodes, and then removing them.

• This approach is designed to avoid or minimise customer-impacting downtime.

• VPN clients may experience brief reconnections (typically a few seconds) during node transitions. Clients should be configured to automatically reconnect.

Maintenance Windows:

• Routine maintenance is typically performed during low-traffic periods (02:00–06:00 UTC) where possible.

• We will provide at least 48 hours' advance notice for planned maintenance that may materially affect service availability.

• Notice will be provided via email to the account contact and/or via the Customer Dashboard.

What's Included:

• Software updates and security patches.

• Infrastructure upgrades and capacity changes.

• Configuration changes and optimisations.

• Certificate renewals and key rotations.

Scheduled Maintenance Exclusion:

• Time during Scheduled Maintenance windows is excluded from availability calculations, provided adequate notice was given.

• If maintenance significantly exceeds the notified window, the excess time may count toward Downtime.

Emergency Maintenance:

• Emergency maintenance may be performed without advance notice where necessary to:

- Address critical security vulnerabilities or active threats.

- Prevent imminent service failures or data loss.

- Comply with urgent legal or regulatory requirements.

• We will notify customers as soon as practicable during or after emergency maintenance.

• Emergency maintenance is excluded from availability calculations.

PrivyNet provides tiered support based on incident severity. Our support team monitors services 24/7 for critical issues.

Support Hours:

• Critical/High Severity: 24/7/365 monitoring and response.

• Medium/Low Severity: Business hours (09:00–18:00 UK time, Monday–Friday, excluding UK bank holidays).

Severity Definitions & Response Times:

| Severity | Definition | Initial Response | Update Frequency |

|----------|-----------|------------------|------------------|

| Critical | Complete service outage affecting all or most customers | Within 1 hour (24/7) | Every 30 minutes |

| High | Major degradation affecting significant functionality or many customers | Within 4 hours (24/7) | Every 2 hours |

| Medium | Partial degradation with limited impact; workarounds available | Within 1 business day | Daily |

| Low | Minor issues, questions, or feature requests | Within 2 business days | As appropriate |

What "Response" Means:

• Initial response means acknowledgement and initial triage of the issue, not resolution.

• We will begin investigation and provide an initial assessment within the response time.

• Resolution times vary depending on the complexity and nature of the issue.

How to Report Issues:

• Critical/High: Email support@privynet.co.uk with subject "URGENT" or "CRITICAL".

• All severities: Submit via the Customer Dashboard support portal.

• Status updates: Check our status page at status.privynet.co.uk for real-time incident information.

Escalation:

• If you are not satisfied with the response to a support request, you may escalate by emailing escalations@privynet.co.uk with your ticket reference.

To receive the benefits of this SLA, customers must meet the following responsibilities:

Account & Credentials:

• Maintain secure, unique passwords for your PrivyNet account.

• Enable multi-factor authentication (MFA) where available.

• Promptly notify us if you suspect credential compromise.

• Keep your account contact email current to receive maintenance and incident notifications.

Client Configuration:

• Configure VPN clients to automatically reconnect after brief disconnections (standard behaviour for most clients).

• Use supported VPN protocols and client software versions.

• Implement appropriate timeout and retry logic in applications that depend on our APIs.

Workload Security:

• Secure any applications or workloads you deploy on our infrastructure.

• Keep your software and dependencies up to date with security patches.

• Implement appropriate redundancy and failover for critical workloads where necessary.

Connectivity:

• Ensure your internet connectivity and local network are functioning correctly.

• Issues with your ISP, local network, or device do not constitute PrivyNet Downtime.

Compliance:

• Comply with our Terms of Service and Acceptable Use Policy.

• Violations of the AUP may void SLA commitments (see Section 7).

Reporting:

• Report issues promptly to help us investigate and resolve them quickly.

• Provide requested diagnostic information (logs, timestamps, affected IPs) to assist troubleshooting.

This SLA does not apply to Downtime or performance issues caused by the following:

Scheduled & Emergency Maintenance:

• Downtime during notified Scheduled Maintenance windows.

• Emergency Maintenance performed to address security or stability issues.

Customer-Side Issues:

• Your internet service provider (ISP) or local network issues.

• Misconfiguration of your VPN clients, applications, or devices.

• Issues with customer-controlled software, firewalls, or security settings.

• Credential compromise or account security issues on your side.

• Failure to follow documented configuration requirements.

Acceptable Use Policy Violations:

• Downtime resulting from suspension or enforcement actions due to AUP violations.

• Service degradation caused by your own abusive or excessive usage.

• Actions taken to protect our infrastructure from abuse originating from your account.

Third-Party Factors:

• Microsoft Azure platform-level outages affecting the underlying infrastructure (covered by Microsoft's own SLA).

• Internet backbone or transit provider outages beyond our network edge.

• DNS issues with third-party DNS providers.

• DDoS attacks or other malicious activity targeting our infrastructure (though we make reasonable efforts to mitigate).

Force Majeure:

• Natural disasters, acts of war, terrorism, or civil unrest.

• Government actions, embargoes, or sanctions.

• Pandemics or public health emergencies.

• Other events beyond our reasonable control as defined in our Terms of Service.

Brief Interruptions:

• Outages lasting less than 5 consecutive minutes.

• Brief reconnections during rolling updates or node transitions.

• Transient network issues that self-resolve within the measurement threshold.

Beta & Unsupported Features:

• Beta, preview, or experimental features.

• Deprecated features or services after the announced end-of-support date.

• Free trial accounts.

If we fail to meet the availability commitments in Section 3, you may be eligible for Service Credits as described below.

Credit Tiers:

| Monthly Uptime Percentage | Service Credit (% of Monthly Service Fees) |

|--------------------------|------------------------------------------------|

| 99.0% – 99.89% | 10% |

| 95.0% – 98.99% | 25% |

| 90.0% – 94.99% | 50% |

| Below 90.0% | 100% |

Credit Calculation:

• Credits are calculated as a percentage of your monthly Service Fees for the affected service.

• "Service Fees" means the fees invoiced for your service plan during the affected month. One-time fees, setup fees, and taxes are excluded.

• If multiple services are affected, credits are calculated separately for each service based on its portion of your fees.

Credit Cap:

• The maximum credit for any calendar month is 100% of your Service Fees for that month.

• Credits cannot exceed the fees actually paid; you will not receive cash refunds or credits exceeding your charges.

Credit Application:

• Approved credits will be applied to your next invoice.

• Credits are not transferable and have no cash value.

• Credits expire if your account is terminated or if not used within 12 months.

• Credits are the sole and exclusive remedy for SLA failures.

To receive Service Credits, you must submit a claim following this process:

Claim Deadline:

• You must submit your credit request within 30 days after the end of the calendar month in which the Downtime occurred.

• Claims submitted after this deadline will not be processed.

How to Submit:

• Email: Send your claim to sla@privynet.co.uk.

• Subject Line: "SLA Credit Request – [Your Account ID] – [Month/Year]".

Required Information:

Your claim must include:

• Your account ID or registered email address.

• The calendar month for which you are claiming credits.

• The specific service(s) affected (e.g., VPN Data Plane, Management API).

• Date(s) and time(s) of the Downtime incidents (in UTC).

• A brief description of the outage and its impact on your use.

• Any relevant logs, screenshots, or error messages (optional but helpful).

Verification:

• We will verify claimed Downtime against our monitoring records.

• If our records differ from your claim, we will provide our data and work with you to resolve discrepancies.

• PrivyNet's monitoring data is the authoritative source for availability calculations.

Response:

• We will respond to credit claims within 10 business days.

• If approved, credits will be applied to your next invoice (or the following invoice if the next invoice is already finalised).

• If denied, we will provide an explanation.

Disputes:

• If you disagree with our decision, you may escalate by emailing legal@privynet.co.uk within 14 days of our response.

Service Credits described in this SLA are your sole and exclusive remedy for any failure by PrivyNet to meet the availability commitments set out herein.

Limitation:

• This SLA does not entitle you to any refunds, only to credits against future invoices.

• Service Credits do not apply to, and cannot be used to offset, usage-based charges, one-time fees, or amounts owed for prior periods.

• You may not unilaterally offset claimed credits against amounts due; credits are applied only after approval.

No Additional Remedies:

• Except as expressly set out in this SLA, PrivyNet makes no warranties or representations regarding availability.

• The limitations of liability in our Terms of Service apply to all SLA matters.

• This SLA does not create any additional rights or remedies beyond those expressly stated.

Relationship to Terms of Service:

• This SLA supplements, and does not replace, the Terms of Service.

• In the event of conflict between this SLA and the Terms of Service regarding availability or credits, this SLA prevails.

• All other matters are governed by the Terms of Service.

Customers with Dedicated VPN Infrastructure may be subject to additional or different SLA terms as specified in their Order Form or custom agreement.

Standard Terms:

Unless otherwise specified in writing:

• Dedicated Infrastructure is subject to the same 99.9% availability target as shared infrastructure.

• Maintenance windows and procedures are the same as for shared infrastructure.

• Service Credits are calculated based on the Dedicated Infrastructure portion of your fees.

Custom SLAs:

• Enterprise customers may negotiate custom SLA terms, including:

- Higher availability commitments (e.g., 99.95%, 99.99%).

- Enhanced support response times.

- Dedicated support contacts.

- Custom maintenance windows.

- Different credit structures.

• Custom SLA terms must be agreed in writing and will be documented in your Order Form or a separate SLA addendum.

• Custom terms take precedence over this standard SLA for the specified services.

Single-Tenancy Considerations:

• Dedicated Infrastructure is provisioned exclusively for your use, but still depends on underlying Azure infrastructure.

• Azure platform-level outages remain excluded from availability calculations.

• You are responsible for providing sufficient notice for capacity changes to avoid self-imposed constraints.

We may update this SLA from time to time. When we do:

Material Changes:

• We will provide at least 30 days' advance notice before reducing availability commitments or service credit entitlements.

• Notice will be provided via email to your account contact and/or via the Customer Dashboard.

• If you do not agree to the changes, you may terminate your service before the changes take effect.

Improvements:

• We may improve availability commitments, increase credits, or enhance support response times without advance notice.

• Improvements take effect immediately upon publication.

Minor Changes:

• For clarifications, formatting, or non-material updates, we may update the SLA without individual notice.

• The "Last Updated" date at the top of this SLA indicates when it was last revised.

Current Version:

• The current version of this SLA is always available on our website.

• Previous versions may be requested by contacting legal@privynet.co.uk.

Continued Use:

• Continued use of our services after changes take effect constitutes acceptance of the revised SLA.

• SLA claims are assessed under the version in effect during the month in question.

This SLA is governed by and construed in accordance with the laws of England and Wales.

Jurisdiction:

The courts of England and Wales shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this SLA.

Relationship to Terms of Service:

• This SLA forms part of the agreement between you and PrivyNet.

• It should be read together with the Terms of Service, which contain additional provisions regarding governing law, dispute resolution, and limitation of liability.

• The order of precedence for conflicting terms is set out in the Terms of Service.

If you have questions about this SLA, need to report an incident, or wish to submit a credit claim, please contact us:

SLA Credit Claims:

• Email: sla@privynet.co.uk

• Include: Account ID, affected month, incident details, and times (UTC).

Incident Reporting:

• Critical/High: support@privynet.co.uk (subject: "URGENT" or "CRITICAL")

• All severities: Customer Dashboard support portal

Status & Updates:

• Status Page: status.privynet.co.uk

• Subscribe to status updates for real-time notifications.

Escalations:

• Email: escalations@privynet.co.uk

• Include your ticket reference and reason for escalation.

General Support:

• Email: support@privynet.co.uk

• Dashboard: Available 24/7 for ticket submission

Response Times:

• SLA credit claims: Within 10 business days.

• Critical incidents: Within 1 hour (24/7).

• General enquiries: Within 2 business days.