Service level agreement
The service levels Entrustt commits to for partners in Production.
1. What this covers
This agreement applies to the Entrustt Production API for partners with a signed Order Form. It does not apply to the Sandbox, to pilots, or to features marked as beta, which are best effort.
Entrustt works in the background. It is not built to sit in the path of a customer transaction, so please design your integration so that your service keeps working if Entrustt is slow or unavailable.
2. Availability
We will use commercially reasonable efforts to keep the Production API available at least [99.5%] of the minutes in each calendar month (the "Uptime Target"). The dashboard has a target of [99.0%] and carries no service credits.
How it is measured. Availability is the minutes in the month, less excluded time, less unavailable minutes, divided by the minutes in the month less excluded time. The API is unavailable when more than half of requests fail with a server error or time out for [5 minutes] in a row, measured by our external checks.
Excluded time. We do not count time lost to:
- scheduled maintenance, up to [8 hours a month], announced at least [5 business days] before and normally in the window of [Sunday 00:00 to 05:00 West Africa Time];
- emergency maintenance, with notice where we can;
- your systems, your webhook endpoint, or a network we do not control;
- events outside our reasonable control, as described in the terms, including a failure of a whole cloud region;
- the Sandbox, beta features, requests that were rate-limited, or a suspension allowed by the terms;
- attacks we could not reasonably have stopped.
3. Service credits
| Monthly availability | Credit, as a share of that month's fee |
|---|---|
| 99.0% up to, but not including, 99.5% | [5%] |
| 95.0% up to, but not including, 99.0% | [10%] |
| Below 95.0% | [20%] (the most in any month) |
To claim, write to support within [30 days] after the end of the month. Credits are applied to future invoices and have no cash value. They are your only remedy for missing the Uptime Target, apart from the right below.
Repeated failure. If availability is below [99.0%] in three of any six months, you may end the affected service without penalty on written notice.
4. Support and response times
Support is available [Monday to Friday, 08:00 to 18:00 West Africa Time (UTC+1)], excluding Nigerian public holidays. For severity 1 we also respond outside those hours on a best-effort basis. These are targets for the first response, not promises about how fast a problem is solved.
| Severity | Example | First response | Updates | Target to restore |
|---|---|---|---|---|
| 1 | Production API is down, or there is a partner-isolation or security concern | [1 hour] in support hours, [4 hours] outside them | Every [2 hours] | [8 hours] |
| 2 | A major feature is degraded, or webhooks are failing broadly | [4 business hours] | Daily | [2 business days] |
| 3 | A minor problem with a workaround | [1 business day] | As needed | [5 business days] |
| 4 | A question or a request for a feature | [2 business days] | As needed | No target |
5. Webhook delivery
- Events are delivered at least once. An event can arrive more than once, and in a different order. Each event has a unique ID. Check the signature on every delivery, ignore an event ID you have already processed, and read current state from the API if order matters.
- A delivery succeeds when your endpoint answers with a 2xx status within [10 seconds]. A redirect counts as a failure.
- If delivery fails, we retry with increasing delays for up to [72 hours]. After that the event is marked failed and your technical contact is told. We may switch off an endpoint that has failed for [5 days in a row], after notice.
- You can ask for an event to be replayed within [30 days] of the event. We keep events for [90 days]. The audit log is kept for longer, as the data processing agreement sets out.
- We aim to make the first delivery attempt within [60 seconds] of the event. This is a target.
6. Incidents and security events
We keep a public status page at [status page address]. For a severity 1 incident we update it within [30 minutes] of confirming the incident, and send a written report within [5 business days].
For a personal data breach affecting your data, we tell you without undue delay and aim to do so within [48 hours] of confirming it, with the information we have. We do this so that you can meet your own duty to notify the Nigeria Data Protection Commission within 72 hours. See the data processing agreement.
7. Backup and recovery
Our targets are to recover data to within [24 hours] of loss (recovery point) and to restore the service within [24 hours] after the loss of a whole region, or [8 hours] after the failure of a single service (recovery time). Backups run [daily] and are kept for [30 days]. We test restores at least [once a year]. These are targets, not guarantees.
8. No other promises
We do not promise uninterrupted or error-free service. Support commitments are response targets, not resolution guarantees. This agreement is part of your agreement with us and is subject to the terms.