SLA Tier Card

1 · Why this document exists

Every procurement officer has the same mental model of an SLA: "if the vendor's system is down, what do I get back?" The naive answer is a credit. The mature answer — the one DEFONEOS offers — is a six-tier ladder with named uptime, response, resolution, credit, bonus pool, escalation owner, and SIGIL-anchored monthly measurement. This card is what a buyer sends to their procurement / CISO / GC / Insurance Broker for tier selection.

The card is deliberately readable in 90 seconds. The full contractual SLA is the MSA Schedule 2, exchanged at signature; this card is the readable front.

2 · The 6 SLA tiers (master table)

Notation: BH = business hours (Mon-Fri 09:00-18:00 UK, excl. UK public holidays); h = clock hours; BD = business days; OOB = out-of-band (satellite phone / secure fax / courier).

3 · Severity definitions (P1 – P4)

4 · Uptime measurement (how we count)

Uptime is measured per calendar month against the buyer's contracted tenant endpoint. The formula:

uptime_pct = ((total_minutes_in_month − excluded_downtime) − incident_minutes) / (total_minutes_in_month − excluded_downtime) × 100

Excluded downtime (not counted against SLA):

• Buyer-side infrastructure (buyer's cloud, network, IAM, DNS)
• Buyer-requested maintenance windows (announced 5 BD in advance)
• Force majeure (war, insurrection, natural disaster, pandemic)
• Buyer's modifications to model weights, prompts, or training data
• Scheduled sovereign upgrades (announced 30 days in advance, max 4 hours/quarter)

Incident minutes are measured from the first SIGIL-anchored P1/P2 incident timestamp to the SIGIL-anchored resolution timestamp. Both timestamps are signed by the 33-agent BFT council at incident close.

5 · Credit ladder (the contractual remedy)

Credits are applied automatically to the next invoice. The buyer does not need to claim them. If a credit is disputed, the dispute process in §10 applies.

6 · Bonus pool (the upside incentive)

Platinum, Sovereign, and Sovereign-Air-Gap tiers include a bonus pool. The pool rewards sustained over-performance:

7 · Escalation owners (named roles)

8 · Measurement & attestation (SIGIL)

Every month's SLA performance is captured in a SIGIL-anchored attestation record:

{
  "att_id": "SLA-2026-07-MEGACORP",
  "tier": "sovereign",
  "period": "2026-07",
  "uptime_pct": 99.994,
  "uptime_target_pct": 99.99,
  "miss": false,
  "p1_count": 0,
  "p2_count": 2,
  "p3_count": 7,
  "p4_count": 14,
  "incident_minutes_excluded": 0,
  "incident_minutes_counted": 3,
  "credit_due_pct": 0,
  "attested_at": "2026-08-05T09:00:00Z",
  "bft_vote_round": 1247,
  "bft_vote_result": "28-approve / 5-amend / 0-reject",
  "ed25519_sig": "a4f8c2d9e1b3...",
  "buyer_verify_url": "https://csoai.org/sla/verify/SLA-2026-07-MEGACORP"
}

Buyers verify any attestation via curl https://csoai.org/sla/verify/{att_id}. Verification is <100ms and returns the full record + BFT vote details.

9 · Maintenance windows (what we exclude)

10 · Dispute resolution (the 30-day window)

1. Buyer receives SIGIL attestation on 5th business day of month following measurement period.
2. Buyer has 30 calendar days to raise dispute (via disputes@csoai.org or buyer's named TAM).
3. Dispute triggers an independent review: DEFONEOS CISO + Buyer CISO + named neutral (typically one of the buyer's appointed auditors).
4. Resolution target: 15 business days from dispute raise. If unresolved at 15 BD, escalation to 33-agent BFT council for binding decision.
5. BFT decision is final and SIGIL-anchored. Buyer may publish decision (with redactions) on buyer's own trust page.

11 · The 5 Anti-Patterns (SLA Disasters We Refuse)

1. No "we'll get to it." P1 SLA times are contractual. Every minute over is a credit minute.
2. No "excluded downtime black box." Excluded downtime is enumerated (§4). Anything not on the list counts.
3. No "credits only on request." Credits auto-apply on the next invoice. Buyer doesn't ask.
4. No "we'll define severity later." Severity definitions (§3) are contractual at MSA signature.
5. No "disputes go to legal." Disputes go to CISO + CISO + neutral (§10). Legal is the last resort, not the first.

12 · Cross-walk to other DEFONEOS artefacts

13 · Buyer Next Steps

1. Verify this document hash: curl https://csoai.org/defoneos-mod-sla-tier-card.html | shasum -a 256
2. Pick a tier (§2) and request the matching fee band quote.
3. Browse live SLA attestation history: csoai.org/sla/{tenant_id}
4. Verify any attestation: csoai.org/sla/verify/{att_id}
5. Request a 60-minute SLA walkthrough with our VP Customer Success.
6. Subscribe to material-incident advisories: csoai.org/advisories/subscribe