FORTANIX DATA SECURITY MANAGER CLOUD SERVICE SLA

The purpose of this Service Level Agreement (“SLA”) is to define the measurable performance levels of the Data Security Manager Cloud Service (“DSM Cloud Service”) and specify the remedies available to Customer if Fortanix fails to achieve these levels. This SLA only applies to the paid Production version of the Fortanix DSM Cloud Service. This SLA does not apply to any Trial Service.

1. Definitions

   All capitalized terms used in this SLA but not defined will have the meaning ascribed to the term in the Agreement. The following additional definitions apply to this SLA.

   • “Downtime” means a five-minute period during which at least ten Valid Requests are received and during which the Error Rate is 10% or more. For purposes of clarity, there is no Downtime if the Error Rate temporarily exceeds 10% during such five-minute period, provided that the aggregate Error Rate during a five-minute period does not exceed 10%.
   • “Error Rate” means the percentage of total Valid Requests received in a five-minute period of time that result in a Response Error, excluding any Response Errors that are Excused Errors. Error Rate is determined by Fortanix’ server-side health monitoring. Expressed another way, Error Rate is calculated as follows: 
   • “Excluded Operation” means an operation from one of the following user, administrator and account management categories performed through the DSM Cloud Service, as described in the published API documentation: (1) apps;(2) groups; (3) accounts; (4) users; (5) logs; and (6) plug ins.
   • “Excused Error” means a Response Error that is due to: (a) circumstances beyond Fortanix’ reasonable control including without limitation, denial of service attacks, natural disasters, changes resulting from government, political, or other regulatory actions or court orders, strikes or labor disputes, acts of civil disobedience, acts of war, acts against parties, and other force majeure items; (b) Customer’s act or omission, or the act or omission of any third-party partner with whom Customer connects; (c) any service failure of a third party system which Customer is using in conjunction with the DSM Cloud Service, including but not limited to those provided by an Internet service provider, network service provider, or cloud service provider; (d) Customer-provided content, data or information or programming errors by Customer; (e) lack of availability by Customer or a failure of Customer to respond in a timely manner to incidents that require its participation for source identification and/or resolution, including meeting Customer responsibilities for any prerequisite services; or (f) Customer’s breach of any of its material obligations under the Agreement.
   • “Included Operation” means an operation from one of the following key management and cryptographic operation categories performed through the DSM Cloud Service, as described in the published API documentation: (1) authentication; (2) security objects;(3) encryption and decryption; (4) sign and verify; (5) digest; and (6) wrapping and unwrapping.
   • “ARC Credit” means a credit of a percentage of the current annual bill paid by Customer for the DSM Cloud Service to be applied to future annual payments by Customer for the DSM Cloud Service that is offered due to a failure to meet the Monthly Uptime Objective during any 1 calendar month period within the 12 months that are covered by that annual bill, as further described in Section 3.
   • “Monthly Uptime Objective” means 99.95 %.
   • “Monthly Uptime Percentage” means the percentage of time in a month that the DSM Cloud Service is available to the Customer, calculated as: 
   • “Response Error” means a response by the DSM Cloud Service to a Valid Request within ten seconds of receipt of such Valid Request of HTTP Status 50x and with one of the following codes: (i) "Internal Error", (ii) "Unknown" or (iii) "Unavailable".
   • “Valid Request” means a request issued by Customer to the DSM Cloud Service to perform an Included Operation that conforms to the then-current Documentation, and that would normally result in a non-error response. For purposes of clarity, requests for Excluded Operations are not deemed Valid Requests and are not subject to this SLA.
2. Customer Responsibilities

   Customer must: (i) provide and keep current valid contact information that includes phone number(s) and email address(es) for both a primary contact and an operational/technical contact (e.g., network engineer or routing engineer); (ii) provide technical configuration details; and (iii) comply with all technical specifications and policies as provided by Fortanix from time to time.
   
   This SLA will apply to Customer’s use of the DSM Cloud Service.

3. ARC Credits

   If the Monthly Uptime Percentage does not meet or exceed the Monthly Uptime Objective in any given month, Customer will be eligible to receive ARC Credits as specified below:

   Monthly Uptime Percentage	Minutes of Downtime (based on 30 day average)	ARC Credit
   ≥ 95 to < 99.95%	23 minutes to ≤ 36 hours	0.8%
   < 95%	> 36 hours	2.0%

   The ARC Credits listed above are Customer’s sole and exclusive remedy for any failure of the DSM Cloud Service, including, without limitation, any failure to meet the Monthly Uptime Objective.

4. ARC Credit Requests

   To receive an ARC Credit, as described above, Customer must notify Fortanix Help Desk within five (5) days of any Downtime in any particular month and request a credit within thirty (30) days of the end of each month during which the Monthly Uptime Percentage failed to meet the Monthly Uptime Objective. All periods of Downtime must be verified by Fortanix. Failure to comply with this requirement will result in waiver of Customer’s right to receive an ARC Credit. The ARC Credits can accumulate within the Term of Agreement. Approved credits will be applied by Fortanix to Customer’s next invoice for the DSM Cloud Service following the approval of the ARC Credit. All unused ARC credits will expire after the term or termination of the Agreement/Purchase Order, without the possibility for the reimbursement.