Enterprise Service Level Agreement

Preamble

This Enterprise Service Level Agreement (“Agreement” or “SLA”) is entered into by Tanqory Inc., a company duly incorporated under the laws of the State of Delaware, United States, with its registered agent at c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA (“Tanqory”, “Provider”, “we”, “us”), and the customer that has executed an Enterprise Plan or Master Service Agreement with the Provider (“Customer”, “you”). By executing or being bound by an Order Form, Master Service Agreement, or Enterprise Subscription Agreement that incorporates this SLA by reference, the parties expressly agree that this SLA forms an integral part of the governing agreement and sets forth the specific service levels, performance metrics, remedies, and operational obligations applicable to the enterprise services provided. This SLA is designed to assure enterprise-grade availability, responsiveness, security, and support, and to provide clear mechanisms for service credits, escalation, and, where applicable, termination rights in the event of chronic service-level failures. It is intended to be read together with the Terms of Service, Terms of Sale, Data Processing Agreement, Acceptable Use Policy, Security Overview, and any applicable regional addenda; in the event of a conflict, the more specific or more recently executed governing agreement will prevail, without prejudice to any mandatory legal rights. Both parties acknowledge that the commitments herein are material inducements for entering into and continuing the enterprise relationship, and that Customer’s eligibility for service credits or other remedies is conditioned on compliance with the prerequisites set out in this SLA (including timely payment, adherence to the Acceptable Use Policy, and prompt cooperation in incident response and troubleshooting). Capitalized terms not otherwise defined herein have the meanings given in the governing agreement. The parties agree to the following terms and conditions.

---

Section 1: General Provisions

Clause 1. Purpose and Scope

1.1 Purpose. This SLA defines service levels, performance metrics, measurement methods, remedies, and obligations for Tanqory’s platform services provided to Enterprise Plan customers to ensure quality and business continuity.
1.2 Legal Status. This SLA forms an integral part of the Master Service Agreement or Enterprise Subscription Agreement. If any term conflicts, the more specific/latest agreement prevails without reducing mandatory consumer rights.
1.3 Services Covered.
(a) Core Platform Services: Storefront Management, Administrative Dashboard, Inventory Management, Order Management, Analytics & Reporting.
(b) API Services: REST API, GraphQL API, Webhooks, SDKs.
(c) Payment Processing Services: Card payments, e-wallets, bank transfers, and other enabled methods.
(d) Data Storage Services: Database storage, file/media storage, backup.
(e) Enterprise Support Services: Technical advisory, incident handling, and Dedicated Account Manager.

1.4 Exclusions.
(a) Beta/experimental features explicitly labeled as such.
(b) Non-production environments (staging/development).
(c) Third-party integrations the Customer enables.
(d) Third-party apps from the Tanqory App Marketplace developed by independent developers.

1.5 Conditions Precedent. SLA rights apply only if: (a) Customer is on Enterprise Plan and fees are paid; (b) Customer complies with the Acceptable Use Policy and Terms of Service; (c) Customer does not violate applicable law.

Clause 2. Definitions

“Availability” means the service is accessible/usable over the internet, excluding permitted exceptions.
“Downtime” means the period the service is not normally accessible/usable due to issues under Provider control; measured from Customer notification or Provider detection (whichever first) until restoration.
“Force Majeure” means events beyond reasonable control (e.g., natural disasters, war, terrorism, strikes, pandemics, government action, major internet outages).
“Scheduled Maintenance” means maintenance announced in advance per this SLA.
“Emergency Maintenance” means urgent maintenance required for security, stability, or to prevent imminent harm.
“Service Credit” means a billing credit remedy for failing to meet the guaranteed service level.
“Response Time” means the time from Customer ticket submission via designated channel to Provider acknowledgement and start of investigation.
“Resolution Time” means the time from start of investigation to resolution or workable workaround.
“Business Day” means Monday–Friday excluding Singapore public holidays.
“Business Hours” means 09:00–18:00 Singapore Time (SGT, UTC+8).

---

Section 2: Availability Commitment

Clause 3. Availability Promise

3.1 Guaranteed Monthly Availability (per calendar month):

Note: These are Tanqory's standard enterprise availability targets, set conservatively based on the platform's current operational baseline. Higher per-service targets may be agreed in an Order Form for specific enterprise customers with associated price and architecture (e.g., a dedicated multi-region deployment). Payment-processor outages caused by an upstream provider (e.g., Stripe) are governed by that provider's own SLA and are excluded from Tanqory's availability calculation under Clause 4.2(d). Availability is measured excluding permitted exceptions (Scheduled/Emergency Maintenance, Force Majeure, third-party network failures beyond Provider control, and Customer/third-party-caused outages).

Clause 4. Calculation and Reporting

4.1 Downtime Calculation. Availability (%) = [(Total minutes in month – Downtime) / Total minutes in month] × 100.
4.2 Exclusions. Downtime excludes: (a) Scheduled Maintenance within limits; (b) Emergency Maintenance; (c) Force Majeure; (d) outages caused by Customer or third-party actions, configurations, or non-Tanqory services; (e) outages during beta/unsupported features or non-production environments.
4.3 Monitoring and Logs. Provider uses centralized monitoring to track uptime; logs are retained for audit. Status Page (https://status.tanqory.com) provides public incident notices.

Clause 5. Service Credits

5.1 Eligibility. If monthly availability for a covered service falls below the guarantee, Customer may request Service Credits.
5.2 Credit Table (Core Platform default):

Credits for API Services, Payment Processing, and Data Storage follow the same proportional structure against their own targets, unless an Order Form states different percentages or feature-/region-specific uptime targets. If feature-level or region-specific uptime is offered (e.g., specific payment corridors), the applicable targets and credits will be set out in the Order Form and prevail for those features/regions.

5.2.1 API Services Credit Table (default unless Order Form overrides):

5.2.2 Payment Processing Credit Table (default unless Order Form overrides):

5.2.3 Data Storage Availability Credit Table (default unless Order Form overrides):

If an Order Form specifies different targets or percentages for any service/feature/region, the Order Form controls for that scope and overrides the default tables above. 5.3 Claim Process. Submit a claim within 30 days after the month end via enterprise@tanqory.com with ticket numbers, timestamps (UTC), affected service, and impact. Provider will validate using monitoring logs. Approved credits apply to the next invoice.
5.4 Limits. (a) Max credit per month: 100% of that month’s fee for the affected service. (b) Credits must be used within 12 months; non-transferable and non-cashable. (c) Credits do not apply to add-ons/consulting/other non-core fees. (d) Credits are the sole remedy for availability shortfalls. (e) Overlapping incidents are counted once for the highest-impact event.

---

Section 4: Enterprise Support

Clause 6. Channels and Severity

6.1 Contact Channels

6.2 Severity Levels

• P1 Critical: Full/near-total outage; payments fail; severe data loss/corruption; active security incident.
• P2 High: Major degradation or core function failure; significant performance drop; impacts many end users.
• P3 Medium: Partial impact with workable workaround; non-core function issue; limited scope.
• P4 Low: General questions, non-urgent requests, feature requests, feedback.

6.3 Response/Resolution Targets

6.4 Required Information When Opening a Case
Provide: (a) severity; (b) description/impact/users affected; (c) start time; (d) screenshots/error logs; (e) related order/store/sub-store ID; (f) emergency contact; (g) for API issues, endpoint/request-id/UTC time for log trace.

Clause 7. Escalation

• Level 1: Support Engineer (0–30 min): Intake, initial analysis, standard playbooks.
• Level 2: Senior Support/Tech Lead (30–60 min): Deeper analysis, cross-team coordination, complex fixes.
• Level 3: Engineering/SME (1–4 hours): Specialized fixes, source-level changes.
• Level 4: VP Engineering/CTO: For critical/widespread events or policy decisions; allocate resources, strategic comms.

Customer may request escalation directly via Account Manager or support channels if progress is unsatisfactory.

---

Section 5: Maintenance

Clause 8. Maintenance Policy

8.1 Scheduled Maintenance

• Preferred window: Sunday 02:00–06:00 SGT (low-traffic period)
• Max duration per event: 4 hours
• Max frequency: 2 per calendar month
• Notice: ≥48 hours via email to technical contacts, Status Page, and dashboard alerts.

8.2 Emergency Maintenance
May occur without the above notice for critical security/stability/data-protection reasons. Provider will notify as soon as practicable.

8.3 Security Updates

---

Section 6: Security and Compliance

Clause 9. Security Standards and Certifications

Tanqory has not been formally certified against the third-party standards listed below. The Information Security Management System (ISMS), Privacy Information Management System (PIMS), and operational controls are designed in accordance with the principles of these standards as part of the Company's pre-certification readiness program.

Subprocessor certifications (e.g., SOC reports from Stripe, AWS, GCP, DigitalOcean) are available from the respective subprocessor on request; Tanqory does not redistribute third-party reports.

Clause 9.2 Security Measures

• Encryption: AES-256 at rest; TLS 1.3 in transit.
• Access Control: RBAC and MFA.
• Logging: Access and activity logs retained for audit.
• Network Segmentation: Service network separated from internal network.
• IDS/IPS: Continuous intrusion detection/prevention.

Clause 10. Security Incident Notification

10.1 Notification Timeline

10.2 Incident Notice Content (as known at the time): nature/scope, data potentially affected, containment/remediation steps, customer guidance, contact point.
10.3 Communication Cadence (Critical/High): notify via registered email/emergency channel + Status Page per 10.1; update at least every 60 minutes until contained; preliminary summary within 24 hours; RCA within 5 business days (unless Force Majeure); include impact, affected users, permanent fixes, prevention. All communications recorded; copies provided on request under confidentiality. If executives/contacts are listed in Runbook/Order Form, send RCA/summary to them and match cadence (≥ every 60 minutes for critical).
10.4 RCA Recipients: Customer may designate recipients (e.g., CTO, CISO, PMO) in Runbook/Order Form; otherwise Provider uses primary contract contacts; list can be updated via Support/Account Manager.

10.5 Operational Alignment: Incident communication cadence, escalation paths, and RCA timelines follow the Provider’s incident runbooks; the Provider will keep runbooks in sync with this SLA (including the timelines in 10.1–10.3) and provide an executive summary of changes on request. The Provider will periodically validate that operational playbooks, contact trees, and notification channels in production match the contacts and timelines stated here; discrepancies will be rectified and communicated via durable medium.

10.6 Material Cybersecurity Incidents: Service disruptions that may constitute a material cybersecurity incident are governed additionally by the Cybersecurity Incident Disclosure Policy at trust-and-security/cybersecurity-incident-disclosure-policy.md, which provides for escalation to the Disclosure Committee for materiality determination.

Clause 11. Security Testing

Customers may request latest security reports or Security Questionnaires under appropriate NDA.

---

Section 7: Backup and Disaster Recovery

Clause 12. Backup Policy

Backups are stored in at least two geographically separate data centers.

Clause 13. Recovery Objectives

Clause 14. Disaster Recovery

• Multi-region footprint: Tanqory operates pods across four business regions (ASIA_PACIFIC, AMERICAS, EUROPE, MIDDLE_EAST_AFRICA) on DigitalOcean, Google Cloud, and Amazon Web Services. The current region map is published at https://trust.tanqory.com/regions.
• Primary and DR pairing per business region:
  • ASIA_PACIFIC: Primary sgp1 / asia-southeast1 / ap-southeast-1 (Singapore); DR within APAC.
  • AMERICAS: Primary nyc1 / us-east1 / us-east-1; DR sfo3 / us-central1.
  • EUROPE: Primary fra1 / europe-west3 / eu-central-1 (Frankfurt); DR ams3 / europe-west1 / eu-west-1 (Ireland).
  • MIDDLE_EAST_AFRICA: Primary me-central1 (Doha) / me-south-1 (Bahrain); DR af-south-1 (Cape Town) or APAC fallback by written agreement.
• Failover Time: ≤30 minutes (automated) within a business region; cross-region failover requires written customer authorization. DR plan is tested at least twice per year; results shared with enterprise customers upon request.

---

Section 8: Enterprise Add-ons

Clause 15. Dedicated Account Manager

Scope: primary contact; coordinates issue resolution/special requests; runs Quarterly Business Reviews (QBR); provides strategic advice and roadmap updates.

Clause 16. Training

Additional custom workshops available at agreed fees.

Clause 17. Feature Requests and Beta Access

Enterprise customers may submit feature requests prioritized in product planning; feasibility depends on technical fit and roadmap. Early/beta access to new features may be offered with direct feedback channels.

Clause 18. Custom Integrations

Provider will support Customer-specific integrations with Tanqory, including technical design advice, Custom APIs (extra fees per scope), and testing/validation.

---

Section 9: Reporting and Transparency

Clause 19. Regular Reports

Monthly reports include:
(a) Uptime Report: availability stats vs. SLA;
(b) Incident Report: outages/disruptions, root cause, and prevention;
(c) Performance Metrics: response time, throughput;
(d) Support Metrics: ticket volumes, response/resolution times;
(e) Usage Report: resource and service usage.

Quarterly Business Review (QBR): performance review, usage trends, improvement opportunities, product roadmap updates, customer feedback, and next-quarter plan.

---

Section 10: General Terms

Clause 20. Term and Renewal

Minimum term: 12 months from service start. Auto-renews for successive 12-month terms unless either party gives at least 60 days’ prior written non-renewal notice.

Clause 21. Changes to SLA

Provider may amend this SLA as needed. Material changes affecting rights/obligations will be notified at least 30 days in advance and take effect in the next contract period. If a change materially reduces service levels, Customer may terminate without penalty by notice within 30 days of the change notice.

Clause 22. Termination

• By Customer: Written notice ≥60 days before end of term; early termination may incur fees per Master Service Agreement.
• Refunds: As per Terms of Sale.
• Chronic SLA Breach: If Provider fails P1/P2 SLA three times within any 90 days, or monthly SLA <99.9% for two consecutive months, Customer may terminate without penalty by written notice within 30 days of last breach. Provider may propose a remediation plan within 15 Business Days; if accepted, termination right is deferred. Credits remain available and other legal rights are preserved; refunds/credits post-termination follow Terms of Sale/Order Form.

Clause 23. Limitation of Liability

23.1 Cap: Total liability arising out of or related to this SLA is capped at fees paid by Customer in the 12 months preceding the event.
23.2 Sole Remedy: Service Credits are the sole and exclusive remedy for availability shortfalls.
23.3 Exclusions: No liability for indirect, special, consequential, or punitive damages; loss of profits, revenue, data, goodwill, business opportunities; or cost of substitute goods/services, even if advised of the possibility.

Clause 23.4 Data Residency/Transfer (clarification)

This SLA does not grant data residency/pinning rights. If the Customer requires data residency, regional hosting, or specific transfer mechanisms, such requirements must be expressly set out in the Order Form and/or Data Processing Agreement. Cross-border transfers will follow the governing agreement/DPA (e.g., SCC/IDTA/Addendum) and applicable law; operational controls will be aligned if residency is contractually agreed.

---

Section 11: Governing Law and Dispute Resolution

Clause 24. Governing Law

This SLA is governed by the laws of Singapore, without regard to conflict-of-law principles.

Clause 25. Arbitration

Disputes arising out of or in connection with this SLA, including its existence, validity, or termination, shall be referred to and finally resolved by arbitration administered by the Singapore International Arbitration Centre (SIAC) under the SIAC Rules in force.
Seat: Singapore. Language: English. Tribunal: one arbitrator unless otherwise agreed. The award is final and binding.

Clause 25.1 Consistency with MSA/ToS

If the Master Service Agreement or Terms of Service specifies a different dispute resolution forum or method, that governing agreement prevails; this SLA’s dispute resolution clause applies only where it is consistent with the governing agreement. Any conflicts are resolved in favor of the governing agreement without reducing mandatory rights. The applicable forum/method in the governing agreement (e.g., courts vs. SIAC) will govern for all disputes, and the parties will amend this SLA if needed to align formally.

---

Section 12: Contact Information

Enterprise Support

• Email: enterprise@tanqory.com
• Phone: +65-6xxx-xxxx (24×7 hotline)
• Status Page: https://status.tanqory.com

Sales / Account Management

• Email: support@tanqory.com
  (Contact channels/phone numbers will be kept current in the Order Form/Runbook; any changes will be notified via durable medium and reflected in operational contact trees.)

Registered Agent (Delaware, USA)
Tanqory Inc.
c/o Harvard Business Services, Inc.
16192 Coastal Highway
Lewes, DE 19958, USA

European Office
Tanqory OÜ
Ahtri tn 12, Kesklinna linnaosa
Harju maakond 10151 Tallinn, Estonia
Registration: 17353783

---

Related Documents

• Terms of Sale
• Terms of Service
• Security Overview
• Data Processing Agreement
• Acceptable Use Policy

---

Change History