Validated Cloud Service Level Agreement
Web version 2.0, posted October 12, 2023 and effective January 1, 2023 (Below is the current SLA. Previous versions of the SLA are further below.)
VALIDATED CLOUD HOSTED SERVICES:
This Service Level Agreement (“SLA”) describes the commitment by Validated Cloud to Client for the facilities, networks, systems, servers, services and platforms (collectively, the “Validated Cloud datacenters and Services for systems hosted within”) for the Hosted Client IT Infrastructure under the agreement(s) executed between Validated Cloud and its Client (“Agreement”).
This SLA specifies the services, service levels, conditions and responsibilities that are applicable to ensure that the Hosted Client IT Infrastructure maintains its availability for its intended purpose.
This SLA will be divided into sections defined by the type of service. Only the contracted service via applicable, executed Order Forms will be applicable to the Client and the type of service and service level commitment will be found in the Client Order Form or Client Change Order Form issued pursuant to the Agreement.
Facilities
Validated Cloud has leased sectioned-off space within global datacenter providers (a minimum Tier 3 datacenter), redundant power, redundant cooling, redundant generators, and annually audited physical security. Validated Cloud does not leverage datacenters for use or service beyond these services. Annual SSAE (current version) SOC Type II reports (or similar ISO reports) are available to Clients for review.
Connectivity
Validated Cloud ensures physical and logical redundancy for connectivity to the internet. The high-availability of Validated Cloud datacenters is self-managed via Boarder Gateway Protocol (BGP) across multiple Tier-1 internet providers for fast and reliable access. Single direct connections (e.g., point-to-point or private lines) should have VPN connections for redundancy as a single port failure can disrupt service. These non-redundant single direct connection failures are outside of the scope of this SLA.
The service commitment does not apply to any unavailability, suspension or termination of third party-provided internet providers, or any other Validated Cloud performance issues: (i) caused by factors outside of Validated Cloud’s commercially reasonable control, including any force majeure event or Internet access or related problems; (ii) that result from any actions or inactions of Client; (iii) that result from Client’s equipment, software or other technology; or (iv) arising from Validated Cloud’s suspension or termination of Client’s right to use the Services in accordance with the Agreement
Services
Infrastructure (IaaS)
All SLAs are measured outside of planned Validated Cloud and/or hosted Client environment maintenance periods. Validated Cloud reserves the right to perform platform maintenance quarterly for any activities that might impact availability or connectivity to the Validated Cloud platform. Every commercially reasonable effort will be made to have Validated Cloud platform maintenance avoid any substantial interruption of availability or connectivity. Albeit rare, a minimum of two weeks’ notice shall be given for these maintenance periods, unless the maintenance is security related and immediate fixes must be applied. Validated Cloud will provide notice for these emergency security fix interruptions with as much notice as is reasonably possible.
It is the responsibility of the Client to verify and keep current contact lists with Validated Cloud. Email notices going to spam/junk mail folders are not the responsibility of Validated Cloud.
The Validated Cloud service platform and infrastructure is monitored 24/7 and any failure of the above will result in a Validated Cloud response without Client intervention.
| Minimum
Availability |
Support | Responsible | |
| Network, Hypervisor, and Storage | 99.925% | 24/7 | Validated Cloud |
All virtual servers, storage platforms and connectivity are configured for high-availability and are in a minimum of N+1 configurations. “Storage” includes SANs, backup storage and the GxP Object Storage (S3 compatible).
System Unavailability:
| Support Level | Response Time | Coverage | Contact Method |
| Production | Up to 1 Hour | 24/7 | Phone and email |
| Non-Critical (Non-Production) | Up to 4 Hours | 12/5 Ŧ |
Service Degradation
| Support Level | Response Time | Coverage | Contact Method |
| Production | Up to 4 Hours | 12/5 Ŧ | |
| Non-Critical (Non-Production) | Up to 8 Hours | 12/5 Ŧ |
Service Degradation is defined as unusable by multiple persons greater than one individual.
IaaS Service Availability Credits
If Validated Cloud fails to meet the availability commitments stated above (outside of maintenance periods), the Client may be eligible for a credit. Credits will be calculated as five percent (5%) of the Validated Cloud Server Cloud/Hosting Fees (category “HST” on the Order or Change Order Forms) for the monthly billing period during which the failure occurred for each hour of infrastructure downtime after the first thirty (30) minutes of downtime, up to a maximum of 25% of the Validated Cloud Server Hosting Fees. Client must notify Validated Cloud of a failure in writing within fourteen (14) days of the day that Client experiences a failure in order to be eligible for a credit. Client is not entitled to a credit if Client is in breach of the Agreement or any other agreements with Validated Cloud; or if Client, in Validated Cloud’s sole opinion, has misused the Validated Cloud; or if the failure was due to Client’s (or Client’s agent’s) acts or omissions, negligence or willful misconduct. This SLA is Client’s sole and exclusive remedy for any failure by Validated Cloud to meet the availability commitments.
Infrastructure as a Service (IaaS)
IaaS includes:
- GxP documentation to keep the infrastructure platforms in compliance. GxP documentation includes proper GxP Change Management, Risk Assessments and Objective Evidence (where applicable).
- Backups: System-level backups are included with all virtual servers. The minimum backup retention period is three (3) days unless the Order Form or Change Order Form overrides this minimum retention period for mutually-agreed extended retention periods.
- Monitoring
- AV [optional to use the Validated Cloud solution, but is required to run on all systems]
- Perimeter security
- Asset management, capacity management, licensing and warranties.
Restores:
Restore events are considered an ad-hoc service request. During business hours Ŧ, restores will be initiated within two (2) hours of a written request once the details of the restore are confirmed. Non-Business hours restore requests will be considered an emergency request and additional charges may apply. The completion of a restoration will be dependent upon size and location (per Client design) of the backup repository. Test restores can be initiated by Client request with the applicable subscribed service or can be performed on an ad hoc basis per the ad hoc rate card fee structure.
Platform as a Service (PaaS)
All Client-initiated changes outside of the following described services will be performed on a mutually agreed-upon schedule. Critical changes will be expedited through the Validated Cloud formal change-control process. All other changes will measure complexity, impact, and risk, and execution will be scheduled to be performed during the same day or may wait for the next maintenance period. An addendum to this SLA can be created and mutually-agreed upon between Validated Cloud and Client with specific tasks and service levels associated with those tasks.
PaaS Includes:
- IaaS services
- GxP documentation to keep supported platforms in compliance. GxP documentation includes Formal Change Management, Risk Assessments and Objective Evidence (where applicable).
- System patching and emergency patch management
- Security Services
- Platform Break/Fix tasks
- Account Management for systems [optional]
- Monitoring and Response
- All PaaS service levels include monitoring and response as part of the PaaS service.
- Hosted GxP Domain management [if applicable]
Any adverse event caused by Client that initiates a service response will be remedied outside of the PaaS service and will be subject to the ad-hoc rate card support rates.
Software as a Service (SaaS):
SaaS Includes:
- All IaaS and PaaS services
- Account Management (Add/Expire/Lockout)
- Password resets
- Permission and Role Management
- Other activities (depending on software) can be included in our SaaS service
- Managing escalation of Tier 3 issues with the software vendor (or creator)
Validated Cloud supported SaaS activities will be covered in a separate SLA document – depending on the supported software.
Disaster Recovery
Hosted Systems that are subscribed to Disaster Recovery as a Service (DRaaS)
Definitions:
RTO: Recovery Time Objective – The maximum amount of time it takes to get a system accessible.
RPO: Recovery Point Objective – The maximum amount of lost data relating to the time of the last scheduled replication job.
The DRaaS service replicates subscribed virtual servers from one Validated Cloud datacenter to another Validated Cloud geographical location. All networking configurations (e.g., internet connectivity, VPN, private network space and security rules) are pre-configured and maintained. Documented DRaaS tests will be conducted annually at a minimum. The maximum RTO/RPO is twenty-four (24) hours. More aggressive RTO and RPOs are available and, upon Client’s request, will be documented in the Order Form or Change Order Form. The same Coverage, Conditions, and Contact Methods apply.
Datacenter Failure
| Support Level | RTO | Coverage | Contact Method |
| Standard | Up to 24 Hours | 24/7 | Validated Cloud to contact Client |
PaaS and DRaaS Credits
If Validated Cloud fails to meet the Response Time commitments stated above (outside of maintenance periods), the Client may be eligible for a credit. Credits will be calculated as five percent (5%) of the Validated Cloud PaaS Fees or DRaaS Fees for the monthly billing period during which the failure occurred for each hour of non-response by Validated Cloud, up to a maximum of 25% of the Validated Cloud PaaS Fees, SaaS Fees or DRaaS Fees. Client must notify Validated Cloud of a failure in writing within fourteen (14) days of the day that Client experiences non-response by Validated Cloud in order to be eligible for a credit. Failure to so notify will disqualify Client from receiving a credit. Client is not entitled to a credit if Client is in breach of the Agreement or any other agreements with Validated Cloud or if Client, in Validated Cloud’s sole opinion, has misused the Validated Cloud; or if the failure was due to Client’s (or Client’s agent’s) acts or omissions, negligence or willful misconduct. This SLA is Client’s sole and exclusive remedy for any failure by Validated Cloud to meet the Response Time commitments.
Notice of Changes to SLA
Validated Cloud may change, discontinue or add SLAs, provided, however, that Validated Cloud will provide at least ninety (90) days’ advance notice for material adverse changes to any SLA.
This Service Level Agreement as of the Effective Date of the Agreement and is incorporated in and is part of the Agreement.
Ŧ 8:00 AM Eastern time to 8:00 PM Monday through Friday except for the following observed holidays: New Years Day, Memorial Day, July 4th, Labor Day, Thanksgiving, Christmas. For emergency support on these days, email, and call. Call the number on the web site and follow the prompts for support.
———————————————————————————————–
Web version 1.0 posted March 15 2018
This Service Level Agreement (“SLA”) describes the commitment by Validated Cloud to Client for the facilities, networks, systems, servers, services and websites (collectively, the “Validated Cloud and Services”) for the Hosted Client IT Infrastructure under the Agreement.
This SLA specifies the services, service levels, conditions and responsibilities that are applicable to ensure that the Hosted Client IT Infrastructure maintains its suitability for its intended purpose and its compliance with regulatory requirements.
This SLA will be broken up into sections defined by the type of service. Only the contracted services will be applicable to the Client and the type of service and service level commitment will be found in the Client Order Form or Client Change Order Form. In the event that there is a deviation or addition to this SLA, the deviation or addition will be stated in a separate document.
All SLAs are measured outside of planned Validated Cloud and/or customer maintenance periods.
All Client-initiated changes outside of the following described services will be performed on a mutually agreed-upon schedule. Critical changes will be expedited through our change-control process. All other changes will measure complexity, impact and risk, and can be performed during the same day or can wait for the next maintenance period. An addendum to this SLA can be created with specific tasks and service levels associated with those tasks.
Service Availability
Facilities
| Availability | Configuration | Supported | Responsible | |
| Electrical
|
99.741% | N+1 | 24/7 | Validated Cloud |
| Air Conditioning | 99.741% | N+1 | 24/7 | Validated Cloud |
| Internet Connectivity | 99.95% | N+1 | 24/7 | Validated Cloud |
N+1 is a configuration where one component in the service can fail and the service still will run at full capacity. Availability statistics are standard minimum requirements for a Tier III facility.
Infrastructure
| Availability | Configuration | Support | Responsible | |
| Network | 99.925% | N+1 | 24/7 | Validated Cloud |
| Hypervisor | 99.925% | N+1 | 24/7 | Validated Cloud |
| Storage Connectivity | 99.925% | N+1 | 24/7 | Validated Cloud |
All virtual servers have high availability configured. The Validated Cloud datacenters are all monitored and any failure of the above will result in a response without Client intervention.
Colocation
| Availability | Configuration | Support | Responsible | |
| Network | 99.925% | N+1 | 24/7 | Validated Cloud |
| Storage | 99.925% | N+1 | 24/7 | Validated Cloud |
| Physical Private Infrastructure | 99.925% | N+1 | 24/7 | Validated Cloud |
Hardware requires redundant Electric, Network and Storage connections to meet these SLAs. Physical Private Infrastructure must be supplied by Validated Cloud. Client-Owned Equipment must be pre-approved by Validated Cloud for this SLA.
Service Availability Credits
If Validated Cloud fails to meet the Availability commitments stated above (outside of maintenance periods), the Client may be eligible for a credit. Credits will be calculated as five percent (5%) of the Validated Cloud Server Hosting Fees for the monthly billing period during which the failure occurred for each hour of infrastructure downtime after the first thirty (30) minutes of downtime, up to a maximum of 25% of the Validated Cloud Server Hosting Fees. Client must notify Validated Cloud of a failure in writing within fourteen (14) days of the day that Client experiences a failure in order to be eligible for a credit. Client is not entitled to a credit if Client is in breach of any agreements with Validated Cloud; or if Client, in Validated Cloud’s sole opinion, has misused the Validated Cloud; or if the failure was due to Client’s (or Client’s agent’s) acts or omissions, negligence or willful misconduct. This SLA is Client’s sole and exclusive remedy for any failure by Validated Cloud to meet the Availability commitments.
SLAs
Service Level Agreement Response Times
The Validated Cloud datacenters are all monitored and any failure of the above will result in a response without Client intervention.
12/5 is defined as 8:00 AM (Eastern Time Zone) to 8:00 PM (Eastern Time Zone) Monday through Friday.
Support Level is defined in the Work Order or Change Work Order and is assigned to each system in the Client SOP.
| Support Level | Response Time | Coverage | Condition | Contact Method |
| Critical | 30 Minutes | 24/7 | Unavailable | Phone and email |
| Basic | 1 Hour | 24/7 | Unavailable | Phone and email |
| Non-Critical | 4 Hours | 12/5 | Unavailable |
| Support Level | Response Time | Coverage | Condition | Contact Method |
| Critical | 1 Hour | 24/7 | Service Degradation | Phone and email |
| Important | 2 Hours | 24/7 | Service Degradation | Phone and email |
| Basic | 4 Hours | 12/5 | Service Degradation | |
| Non-Critical | 8 Hours | 12/5 | Service Degradation |
Service Degradation is defined as a component of the hosted service being broken (and not “slowness”).
Infrastructure as a Service (IaaS)
IaaS includes:
- GxP documentation to keep the infrastructure platforms in compliance. GxP documentation includes proper GxP Change Management, Risk Assessments and Objective Evidence (where applicable).
- Backups: System-level backups are included with all virtual servers. The default backup retention is 3 days unless the Order Form or Change Order Form overrides this default.
Restores:
Restore events are considered an ad-hoc service request. Restores will be initiated within two hours of a written request once the details of the restore are confirmed. The completion of a restoration will be dependent upon size and location of the backup. Test restores can be initiated by client request.
Platform as a Service (PaaS)
PaaS Includes:
- IaaS services
- GxP documentation to keep supported platforms in compliance. GxP documentation includes Change Management, Risk Assessments and Objective Evidence (where applicable).
- System patching and emergency patch management
- Security Services
- Platform Break/Fix tasks
- Account Management for systems
- Monitoring and Response
- Expanding resources (CPU, RAM, Disk)
- All PaaS service levels include monitoring and response as part of the PaaS service.
Any adverse event caused by Client that initiates a service response will be remedied outside of the PaaS service and will be subject to the ad-hoc support rates.
Software as a Service (SaaS)
SaaS Includes:
- All IaaS and PaaS services
- Account Management (Add/Expire/Lockout)
- Password resets
- Permission and Role Management
- Other activities (depending on software) can be included in our SaaS service
- Managing escalation of Tier 3 issues with the software vendor (or creator)
Validated Cloud supported SaaS activities will be covered in a second SLA document.
Disaster Recovery
Validated Cloud Hosted Systems
| Support Level | RTO/RPO | Coverage | Condition | Contact Method |
| Critical | 3 Hour | 24/7 | Datacenter Failure | Validated Cloud to phone customer |
| Aggressive | 6 Hours | 24/7 | Datacenter Failure | Validated Cloud to phone customer |
| Important | 12 Hours | 24/7 | Datacenter Failure | Validated Cloud to phone customer |
| Basic | 24 Hours | 24/7 | Datacenter Failure | Validated Cloud to phone customer |
| Non-Critical | N/A | N/A | N/A | N/A |
Documented DR tests will be conducted annually.
RTO: Recovery Time Objective – The maximum amount of time it takes to get a system accessible
RPO: Recovery Point Objective – The maximum amount of lost data relating to the time of the last scheduled replication job.
Validated Cloud being used as Disaster Recovery as a Service (DRaaS)
| Support Level | RTO/RPO | Coverage | Condition | Contact Method |
| Critical | 3 Hour | 24/7 | Client Datacenter Failure | Phone |
| Aggressive | 6 Hours | 24/7 | Client Datacenter Failure | Phone |
| Important | 12 Hours | 24/7 | Client Datacenter Failure | Phone |
| Basic | 24 Hours | 24/7 | Client Datacenter Failure | Phone |
| Non-Critical | 72 Hours | 12/5 | Client Datacenter failure |
Documented DR tests will be conducted annually.
PaaS and DRaaS Credits
If Validated Cloud fails to meet the Response Time commitments stated above (outside of maintenance periods), the Client may be eligible for a credit. Credits will be calculated as five percent (5%) of the Validated Cloud PaaS Fees or DRaaS Fees for the monthly billing period during which the failure occurred for each hour of non-response by Validated Cloud, up to a maximum of 25% of the Validated Cloud PaaS Fees or DRaaS Fees. Client must notify Validated Cloud of a failure in writing within fourteen (14) days of the day that Client experiences non-response by Validated Cloud in order to be eligible for a credit. Client is not entitled to a credit if Client is in breach of any agreements with Validated Cloud or if Client, in Validated Cloud’s sole opinion, has misused the Validated Cloud; or if the failure was due to Client’s (or Client’s agent’s) acts or omissions, negligence or willful misconduct. This SLA is Client’s sole and exclusive remedy for any failure by Validated Cloud to meet the Response Time commitments.
Service Level Agreement as of the Effective Date of the Validated Cloud Hosting Agreement and agree that the same is incorporated in and is part of the Agreement.