Service Level Agreement (SLA) — Template
DRAFT — TEMPLATE — FOR REVIEW BY INDEPENDENT LEGAL COUNSEL. Tracks OilFlow's actual operational posture as of the pivot launch (2026-06-02). Numeric commitments below are calibrated to what the existing infrastructure (Vercel + Supabase + smoke pipeline) supports today and could be tightened over time.
This Service Level Agreement applies to Customer's subscription to the OilFlow compliance APIs under the executed MSA.
1. Uptime Commitment
| Service tier | Monthly uptime |
|---|---|
| Regulatory Matrix API (SKU #1) | 99.5% |
| Counterparty KYC-as-API (SKU #2) | 99.5% |
| Scam Cluster Intelligence Feed (SKU #3) | 99.5% |
| Trade-Compliance Workflow Suite (SKU #4) | 99.9% (enterprise) |
"Monthly uptime" means the percentage of total minutes in a calendar month during which the affected Service was available to receive and respond to API requests, excluding Scheduled Maintenance.
2. Latency Commitment
| Endpoint | p95 response time | p99 response time |
|---|---|---|
| GET /api/v1/regulatory/* | < 500 ms | < 1000 ms |
| POST /api/v1/kyc/screen | < 2000 ms | < 5000 ms |
| GET /api/v1/clusters/* | < 500 ms | < 1000 ms |
Measured from the OilFlow edge ingress to response egress, excluding network time between the Customer's client and OilFlow's edge.
3. Scheduled Maintenance
3.1 OilFlow may perform scheduled maintenance up to four (4) hours per calendar month, with at least 48 hours' advance notice via email to the operations contact on file.
3.2 Scheduled maintenance windows do not count against the uptime commitment.
4. Excluded Downtime
The uptime commitment excludes downtime caused by:
- (a) Customer's acts or omissions, including incorrect API key usage
or quota exhaustion;
- (b) Third-party services not under OilFlow's control (e.g., upstream
sanctions list maintainers);
- (c) Force majeure;
- (d) Beta or pre-release features clearly designated as such.
5. Service Credits
5.1 If monthly uptime falls below the commitment, Customer may request service credits applied to the next monthly invoice:
| Monthly uptime | Service credit |
|---|---|
| < 99.5% but ≥ 99.0% | 10% of monthly fee for the affected SKU |
| < 99.0% but ≥ 95.0% | 25% of monthly fee for the affected SKU |
| < 95.0% | 50% of monthly fee for the affected SKU |
5.2 Customer must request service credits within 30 days of the end of the month in which the SLA shortfall occurred.
5.3 Service credits are the sole and exclusive remedy for SLA shortfalls.
6. Status Communications
6.1 OilFlow maintains a public status page at https://status.oilflow.us (provisioning post-launch). Incident updates are posted within 15 minutes of confirmation.
6.2 For Severity 1 incidents (API fully unavailable), OilFlow will notify the Customer operations contact within 30 minutes of confirmation, with updates at least every 60 minutes until resolution.
7. Support Channels and Response Times
| Severity | Definition | Initial response (business hours) | Initial response (after hours) |
|---|---|---|---|
| S1 — API down | All SKU endpoints returning errors or unreachable | 15 minutes | 30 minutes |
| S2 — Major impact | One SKU endpoint substantially degraded or wrong-output | 1 hour | 2 hours |
| S3 — Minor impact | Single endpoint degraded; workaround available | 4 hours | Next business day |
| S4 — Questions | Documentation, integration, billing | 1 business day | Next business day |
Business hours: 09:00–18:00 Pakistan Time (UTC+5) Mon–Fri, excluding US and Pakistani public holidays. After-hours support is on-call rotation for S1 and S2 only.
8. Backup and Recovery
8.1 OilFlow maintains daily point-in-time backups of customer-impacting data with a 7-day retention window (longer on enterprise contracts).
8.2 Recovery Point Objective (RPO): 24 hours. Recovery Time Objective (RTO): 4 hours for S1 incidents.
9. Reporting
9.1 OilFlow shall provide a monthly uptime report on Customer's request, listing scheduled maintenance, recorded incidents, and aggregate uptime percentage.
9.2 Customer's own usage and outcomes are available via the apirequestlog audit endpoint (post-migration-118 deployment).
Effective Date: Co-terminous with the MSA Effective Date. Last Updated: ___________________