Service Level Agreement

1. Service availability

1.1 CHI will use commercially reasonable efforts to make the Service available with a Monthly Uptime of at least 99.5%, measured as the percentage of minutes in a calendar month during which the core application is available, excluding Excluded Downtime. A minute is treated as unavailable where more than 5% of requests to the core application in the five-minute window ending with that minute return an HTTP 5xx error. A minute in which no requests are received is treated as available. Monthly Uptime is measured by CHI’s monitoring systems, which are the authoritative record for SLA purposes; CHI will make the underlying measurement data available to the Customer on reasonable request in the event of a dispute.

1.2 “Excluded Downtime” means unavailability caused by: (a) Scheduled Maintenance; (b) Emergency Maintenance; (c) factors outside CHI’s reasonable control, excluding any failure of a sub-processor listed in the DPA (for which CHI remains responsible) but including force majeure, failures of public internet connectivity, and the Customer’s own systems, configurations or misuse; and (d) suspension in accordance with clause 4.3 of the MSA.

2. Scheduled & emergency maintenance

2.1 Scheduled Maintenance is performed where practicable outside business hours (as defined in the MSA: 09:00–17:00 UK time on a Business Day) with at least 48 hours’ notice by email or in-product notice.

2.2 Emergency Maintenance (e.g. to address a security vulnerability) may be performed with shorter or no notice; CHI will notify the Customer as soon as reasonably practicable.

3. Service credits

3.1 If Monthly Uptime falls below the target, the Customer may request Service Credits against the affected month’s fees:

3.2 Credits must be requested in writing within 30 days of the affected month and are capped at the fees paid for that month, the monthly fee being one-twelfth of the annual subscription fee stated in the Order Form (or the fee actually invoiced for that month, where billed monthly). Credits are applied against future invoices, have no cash value, and do not accrue for any month in which the Customer has undisputed overdue amounts.

3.3 Service Credits are the Customer’s sole and exclusive financial remedy for availability failures, save that they are not the Customer’s remedy for, and do not limit CHI’s liability in respect of, a personal data breach or any breach by CHI of its security obligations under the DPA, even where that breach also causes or presents as unavailability. They do not limit the Customer’s right to terminate: if Monthly Uptime falls below 99.0% in any three months within a rolling six-month period, the Customer may terminate the affected Order Form on 30 days’ written notice, and CHI will refund the pro-rata portion of prepaid fees for the unused remainder of the Subscription Term.

4. Support

4.1 Support is provided by email to support@cyberhorizon.co and via in-product channels during UK business hours. Formal notices under the Agreement are given under clause 13.5 of the MSA and must not be sent to the support address.

4.2 CHI will use reasonable efforts to meet the following target response times (time to first substantive response, not resolution). Targets are measured during UK business hours, subject to clause 4.3, and vary by the plan stated in the Order Form. Enterprise response targets are set in the applicable Order Form and prevail over this table where they differ.

4.3 Security incidents outside business hours. CHI does not currently operate a staffed 24/7 support desk. Outside UK business hours CHI monitors an alerting channel for S1 security and availability incidents and will respond on a best-efforts basis; the S1 targets in clause 4.2 are measured during business hours only. This does not affect CHI’s personal-data breach notification obligations under the DPA, which run from the time CHI becomes aware of the breach and are not limited to business hours. Customers requiring a contractual 24/7 response commitment can agree one in the Order Form.

5. Continuity, backup & recovery

5.1 Customer Data is stored in the European Union by default (Supabase, eu-west-1). Per-organisation regional residency in the United States, the United Kingdom and APAC is available on request; a dedicated regional project is provisioned before data is loaded. No managed region is currently available in the Middle East. CHI’s sub-processors, the services they provide and the regions in which they process Customer Data are listed in the DPA. Where processing takes place outside the UK or EEA, CHI applies the transfer safeguards set out in the DPA. Customer Data is encrypted in transit (TLS 1.3) and at rest (AES-256).

5.2 CHI maintains a Recovery Point Objective (RPO) of 24 hours and a Recovery Time Objective (RTO) of 24 hours for the production Service following a major disruption. Backup restoration is tested at least annually, and a summary of the most recent test is available on request.

6. Incident communications

Security or availability incidents materially affecting the Customer are communicated in line with CHI’s documented Incident Response process; notifiable personal-data breaches are handled under the DPA.

7. Review

CHI reviews this SLA at least annually. CHI may update it with effect from the start of the Customer’s next Renewal Term; no update will materially reduce the service levels applicable to the Customer’s then-current paid term.

Previous versions

Agreements are version-stamped at signature. If your Order Form names an earlier version, that version governs and remains published: SLA v1.1.