Support and Service Levels

1.1 This Support and Service Level Agreement Policy (this “SLA Policy”) sets out:

1. the support services that CipherCru Innovations Private Limited (“CipherCru”) provides to clients following delivery of software, systems, and related technology services;
2. the service level commitments (response times, resolution targets, uptime targets) that CipherCru undertakes for supported systems;
3. the remedies available where CipherCru fails to meet its service level commitments;
4. the exclusions, limitations, and conditions that apply to support and SLA obligations.

1.2 This SLA Policy applies to all engagements where the applicable Statement of Work (SOW) or Master Services Agreement (MSA) references or incorporates it. Specific SLA tiers, uptime targets, and support hours applicable to a particular engagement are set out in the relevant SOW Schedule or Support Schedule agreed between the Parties.

1.3 In the event of a conflict between this SLA Policy and the MSA or an applicable SOW, the SOW prevails, followed by the MSA, followed by this SLA Policy.

2.1 In-Scope. This SLA Policy covers support and service level obligations for software applications, systems, and modules developed and delivered by CipherCru under an applicable SOW; integrations, APIs, and infrastructure configurations delivered by CipherCru; managed hosting or infrastructure management services where CipherCru has been engaged to manage the Client's cloud or server infrastructure; and AI-powered components, automation workflows, and data pipelines delivered by CipherCru, subject to the AI-specific provisions in Section 14.

2.2 Out-of-Scope. This SLA Policy does not cover:

1. issues arising from the Client's own systems, third-party software, or infrastructure not managed by CipherCru;
2. services during a warranty period, which are governed by the Warranty provisions of the MSA;
3. end-user training, content updates, or business process changes;
4. new feature development or enhancements, which require a Change Order under the MSA;
5. any system or service that the Client has modified without CipherCru's knowledge and written consent;
6. issues caused by Client actions, including failure to maintain the operating environment, installation of unauthorised software, or configuration changes made by the Client without CipherCru's approval.

3.1 The following terms have the meanings set out below.

4.1 CipherCru offers three standard SLA Tiers. The Tier applicable to a particular engagement is specified in the relevant SOW. Clients may upgrade their Tier by executing an amended SOW or a Change Order.

5.1 Service Desk. All Support Requests must be submitted through one of the following channels.

5.2 Required Information. Each Support Request must include the name, email, and contact details of the reporting person; the name and version of the Supported System; the Client's initial assessment of the Severity level (CipherCru reserves the right to re-classify); a detailed description of the issue, including steps to reproduce, expected behaviour, and actual behaviour; screenshots, error logs, or other evidence where available; and the business impact of the issue.

5.3 Acknowledgement. CipherCru will acknowledge receipt of a Support Request within thirty (30) minutes for Severity 1 issues and within one (1) Business Hour for all other severity levels, during coverage hours. Receipt acknowledgement starts the clock for Initial Response Time measurement.

5.4 Ticket Reference. Upon receipt, CipherCru will assign a unique Ticket reference number. The Client must reference this number in all subsequent communications about the same issue.

6.1 CipherCru classifies all Support Requests into one of four Severity levels.

Definition. A complete outage or severe degradation of the Supported System that renders the Supported System entirely unavailable or non-functional; or causes data loss, data corruption, or a security breach; or has a critical financial, operational, or reputational impact on the Client's business; and has no available workaround.

Examples. Production system down; complete API failure; payment processing failure; data breach detected; authentication system failure; total database unavailability.

CipherCru obligations. Immediate escalation to senior engineering and on-call resources; continuous engagement until resolved or an acceptable workaround is implemented; status updates to the Client at least every sixty (60) minutes.

Definition. A significant degradation of a major feature or function of the Supported System that materially impacts the Client's core business operations, and has no simple workaround, or the available workaround is operationally burdensome.

Examples. Core business workflow unavailable, such as degraded order processing or a key integration failing; major performance degradation, with response times over three times normal; significant data inconsistency in business-critical records.

CipherCru obligations. Senior engineer assigned within Initial Response Time; status updates every four (4) Business Hours until resolved.

Definition. A non-critical function or feature is impaired, causing inconvenience or partial limitation of functionality, but core operations can continue using a workaround or alternative approach, or the impact is limited to a subset of users or use cases.

Examples. Minor UI errors; non-critical third-party integration failing; report generation error; non-blocking performance degradation; single-user access issue.

CipherCru obligations. Assigned to the development queue; status update every three (3) Business Days until resolved.

Definition. A cosmetic defect, minor usability issue, or enhancement request that has negligible impact on business operations and has a simple workaround.

Examples. Typographical errors; UI styling inconsistencies; minor label mismatches; documentation updates; feature improvement suggestions.

CipherCru obligations. Logged and queued for the next planned release cycle; reviewed at the monthly service review, where applicable.

6.2 Severity Re-classification. CipherCru may re-classify a Support Request upward or downward based on its own investigation. CipherCru shall notify the Client of any re-classification with reasons. If the Client disagrees, the Parties shall escalate in accordance with Section 8.

6.3 Upgrade on Impact Change. If the business impact of an issue increases during resolution, for example where a Severity 3 issue causes a cascade that takes down a critical system, either Party may request re-classification to a higher Severity. CipherCru shall re-assess within two (2) hours of receiving a Client request for re-classification.

7.1 Internal Escalation. CipherCru's internal escalation matrix is as follows.

7.2 Client-Initiated Escalation. The Client may request escalation at any time by emailing escalations@ciphercru.com with the Ticket reference and the words “ESCALATION REQUEST” in the subject line, or by contacting the Client's designated Account Manager directly.

7.3 Escalation Contacts. Named escalation contacts for each level above, with their direct addresses, are issued to the Client at onboarding and recorded in the applicable SOW. Where a named contact is unavailable, escalations@ciphercru.com reaches the escalation path directly.

8.1 If the Client disputes CipherCru's Severity classification or believes that a Support Request is being inadequately prioritised, the Client shall follow the escalation process in Section 7.2.

8.2 If the dispute is not resolved within twenty-four (24) hours of escalation, it shall be escalated to the executive contacts in the MSA's dispute resolution matrix and handled in accordance with the MSA's dispute resolution provisions.

9.1 Standard Maintenance Window. CipherCru's standard Scheduled Maintenance Window is Saturday, 01:00 IST to 05:00 IST.

9.2 Advance Notice. CipherCru shall provide the Client with at least 72 hours' written notice of routine Scheduled Maintenance, and at least 24 hours' written notice of urgent, non-emergency maintenance.

9.3 Emergency Maintenance. In the event of an imminent security threat, critical vulnerability, or system failure requiring Emergency Maintenance, CipherCru shall provide as much notice as practicable, which may be less than 24 hours; shall minimise the duration of Emergency Maintenance; and Emergency Maintenance does not count as Downtime for Uptime SLA calculation purposes.

9.4 Alternative Window. The Scheduled Maintenance Window may be varied by mutual written agreement for a specific engagement in the applicable SOW.

10.1 The following periods of unavailability are excluded from the Downtime calculation and do not count against the Uptime SLA:

1. Scheduled maintenance: planned downtime within the agreed Scheduled Maintenance Window with proper advance notice;
2. Emergency maintenance: emergency maintenance carried out with reasonable advance notice as described in Section 9.3;
3. Client-caused issues: downtime caused by the Client's actions or omissions, including changes made to the Supported System by the Client or its third parties without CipherCru's knowledge or consent; the Client's network issues, ISP outages, or connectivity failures on the Client's side; the Client's failure to maintain the approved operating environment (operating system versions, dependencies, browser versions); and the Client's misuse of the Supported System in breach of the MSA or applicable SOW;
4. Third-party provider outages: outages caused by third-party infrastructure providers such as cloud providers, CDNs, payment gateways or SMS providers, that are outside CipherCru's direct control, provided CipherCru has used reasonable efforts to mitigate;
5. Force majeure events: events as defined in the MSA, including natural disasters, government orders and cyberattacks on infrastructure providers;
6. Client delay: delay in the Client providing access, approvals, credentials, or information necessary for CipherCru to resolve an issue;
7. Beta and preview features: unavailability of features marked as beta, preview, or experimental.

11.1 Entitlement. Where CipherCru fails to achieve the Uptime SLA or SLA Tier response targets in a Measurement Period, the Client is entitled to claim a Service Credit in accordance with the schedule below.

11.2 Uptime service credit table.

For Essential Tier clients with a 99.0% Uptime SLA, the credit table applies relative to the committed target. An Essential Tier client whose system achieves 99.0% is not entitled to a credit.

11.3 SLA Response Time Credit Table. Where CipherCru misses an Initial Response Time target or Resolution Time target for a Severity 1 or Severity 2 issue in a Measurement Period:

11.4 Claim Process. To claim a Service Credit, the Client must submit a written Service Credit claim to CipherCru within thirty (30) calendar days of the end of the Measurement Period in which the SLA failure occurred; the claim must specify the affected Ticket numbers, the dates and duration of the failure, and the credit claimed; CipherCru shall review the claim against its logs and monitoring records and respond within fifteen (15) Business Days; and CipherCru shall apply any agreed Service Credit to the Client's next invoice.

11.5 Maximum Credit Cap. The total Service Credits payable in any calendar month shall not exceed fifty percent (50%) of the monthly support fee for that Measurement Period. Service Credits are cumulative within a month but subject to this cap.

11.6 Sole Remedy. Service Credits are the Client's sole and exclusive remedy for CipherCru's failure to achieve the Uptime SLA or SLA response targets. Service Credits do not constitute an acknowledgement of fault or liability.

11.7 No Cash Value. Service Credits are credits against future invoices only and are not redeemable for cash, refunds, or other compensation.

12.1 CipherCru implements monitoring appropriate to the applicable SLA Tier. Essential Tier: automated uptime monitoring with alert notifications to CipherCru's operations team upon detection of a Downtime event. Professional Tier: standard monitoring including uptime, error rate, CPU and memory alerts, and API response time monitoring, with dashboard access for the Client. Enterprise Tier: advanced monitoring including real-time dashboards, synthetic transaction monitoring, anomaly detection, log aggregation, and SLA compliance reporting.

12.2 Monitoring Tool. CipherCru uses industry-standard uptime and performance monitoring. The specific tooling in use for an engagement is named in the applicable SOW, and the Client may request access to the monitoring dashboard as part of the applicable SLA Tier.

13.1 Monthly SLA Report. For Professional and Enterprise Tier clients, CipherCru shall provide a monthly SLA report within five (5) Business Days of the end of each Measurement Period, including the Monthly Uptime Percentage achieved; the total number of Support Requests received, resolved, and open; a breakdown of tickets by Severity level; Initial Response Time and Resolution Time performance against targets; any Scheduled or Emergency Maintenance events; any Service Credits due; and a root-cause summary for any Severity 1 or Severity 2 issues.

13.2 Quarterly Executive Review (Enterprise Tier). For Enterprise Tier clients, CipherCru shall conduct a quarterly executive review covering SLA performance trends over the quarter; known risks and mitigation actions; planned improvements to the Supported System; roadmap alignment and upcoming releases; and any changes to the support team or service delivery model.

14.1 AI Output Disclaimer. CipherCru's standard AI output disclaimers, as set out in the MSA and applicable SOW, apply to AI-powered components of the Supported System. CipherCru's SLA obligations cover the availability and functional operation of AI components, not the accuracy, quality, or outputs of AI-generated content. CipherCru does not warrant that AI outputs will be error-free, accurate, or suitable for any particular purpose.

14.2 Third-Party AI Provider Dependency. Where AI components of the Supported System depend on third-party AI provider APIs, downtime caused by third-party AI provider outages is Permitted Downtime under Section 10.1; CipherCru shall implement fallback mechanisms where technically feasible, such as graceful degradation or alternative provider routing, and shall notify the Client if a fallback is activated; and changes in third-party AI provider pricing, models, APIs, or terms of service may necessitate a Change Order if they materially affect the Supported System's functionality or operating costs.

14.3 AI Model Updates. CipherCru may update, retrain, fine-tune, or replace AI models underlying the Supported System during Scheduled Maintenance Windows. Where a model update is expected to materially change the behaviour or outputs of the Supported System, CipherCru shall notify the Client at least seven (7) Business Days in advance and allow the Client a reasonable testing period before production deployment.

15.1 Staffing. CipherCru shall maintain a support team with sufficient technical knowledge of the Supported System to fulfil its obligations under this SLA Policy.

15.2 Team Composition. The support team includes, as applicable, first-line support engineers with knowledge of the Supported System and standard troubleshooting procedures; second-line senior or specialist engineers with deep technical knowledge of the system architecture and codebase; and a named Account Manager, for Professional and Enterprise Tier, as the Client's primary point of contact.

15.3 Team Changes. CipherCru reserves the right to change members of the support team. Where the Client's named Account Manager or Senior Engineer changes, CipherCru shall notify the Client at least five (5) Business Days in advance and ensure a proper handover.

16.1 Support (covered by SLA). The following activities are covered under this SLA Policy: diagnosing and resolving Defects in the Supported System as delivered; restoring the Supported System to its documented specifications; applying urgent security patches; and assisting the Client in understanding and using existing features.

16.2 Change Requests (not covered by SLA). The following require a separate Change Order under the MSA and are not covered by this SLA Policy:

1. new features or enhancements not included in the original SOW scope;
2. changes to integrations necessitated by updates to third-party APIs, other than critical security fixes;
3. upgrades to underlying technology stacks, including programming language versions, database versions, and framework updates beyond security patches;
4. migration to new infrastructure or cloud providers;
5. performance optimisation projects beyond standard troubleshooting;
6. content updates, data migrations, or configuration changes requested by the Client.

16.3 Classification Disputes. If the Parties disagree on whether a request constitutes a Support Request or a Change Request, they shall follow the escalation process in Section 7 to resolve the disagreement.

17.1 To receive the full benefit of this SLA Policy, the Client shall maintain the approved technical environment (server configurations, browser versions, operating system versions, dependencies) as specified in the applicable SOW or as reasonably updated by CipherCru with advance notice; and respond promptly to CipherCru's queries, requests for information, and requests for access that are necessary for CipherCru to diagnose and resolve issues. Where the Client fails to respond within the timeframes below, the SLA clock is paused until the Client responds.

The Client shall also maintain up to three designated contacts authorised to submit Support Requests on its behalf; provide accurate, detailed, and reproducible descriptions of issues; cooperate with CipherCru's support team in diagnosing issues, including providing access to relevant systems, logs, and data as required; and not make changes to the Supported System without following the Change Request process in the MSA. CipherCru's SLA obligations are suspended in respect of any part of the Supported System modified by the Client without CipherCru's approval.

18.1 Support services under this SLA Policy are provided on the terms set out in the applicable SOW, including the monthly support fee (fixed retainer) for the applicable SLA Tier, and any additional fees for out-of-scope activities such as Change Requests, extended support, or emergency support outside contracted hours.

18.2 Out-of-Hours Support. For Essential Tier clients, Severity 1 support outside Business Hours may be provided at CipherCru's prevailing emergency support rate, as agreed in the applicable SOW or on a case-by-case basis.

19.1 CipherCru's total liability to the Client in respect of failures to meet the SLA commitments in this SLA Policy is limited to the Service Credits set out in Section 11, which constitute the Client's exclusive remedy for SLA failures.

19.2 CipherCru shall not be liable for any indirect, consequential, or punitive damages arising from SLA failures, including loss of profits, loss of revenue, loss of data, or loss of business opportunity.

19.3 Nothing in this SLA Policy limits CipherCru's liability for death or personal injury caused by negligence, fraud, or any liability that cannot be excluded under Applicable Law.

20.1 This SLA Policy is governed by the laws of India. The courts at Jaipur, Rajasthan, India shall have exclusive jurisdiction over disputes relating to this SLA Policy, subject to the dispute resolution procedure in the MSA.

21.1 CipherCru reviews this SLA Policy at least annually and reserves the right to update it, subject to the following: any update that reduces a committed SLA level requires the Client's written consent or thirty (30) days' advance written notice; and updates that do not reduce committed SLA levels, such as additional channels or improved targets, may be made unilaterally with fourteen (14) days' notice.

21.2 The applicable version of this SLA Policy at the time an engagement commences is the version that governs that engagement unless the Parties agree in writing to apply a newer version.