Service Level Agreement

01

Overview & Scope

This SLA defines the service levels Constant Tech Systems commits to delivering for managed IT services, cloud infrastructure management, EDI platform operations, network infrastructure support, cybersecurity monitoring, and related services ("Covered Services") provided under a current, active agreement.

This SLA does not apply to:

• Professional services, project work, or one-time engagements unless explicitly stated in the applicable SOW.
• Software or systems not managed by Constant Tech Systems.
• Client-owned or third-party infrastructure outside the scope of our management agreement.
• Free trial, pilot, or beta service periods.

Service level commitments take effect on the date the applicable SOW or MSA is executed and remain in effect for the duration of that agreement, subject to the terms herein.

02

Service Tiers

Covered Services are delivered under one of the following tiers as specified in the Client's SOW or Service Order. Each tier carries distinct uptime, response, and support commitments.

The applicable tier is identified in the Client's Service Order. Clients may upgrade tiers at any time with 30 days' written notice; downgrades take effect at the next contract renewal.

03

Uptime Commitment

Availability Calculation

Monthly uptime percentage is calculated as follows:

Uptime % = ((Total minutes in month − Downtime minutes) ÷ Total minutes in month) × 100

"Downtime" means the total accumulated minutes in a calendar month during which the Covered Service is unavailable due to causes within Constant Tech Systems' reasonable control, excluding Excused Downtime defined in Section 8.

Maximum Allowable Downtime per Tier

04

Incident Priority & Response Times

All incidents are assigned a priority level at the time of logging. Response time is defined as the time from ticket creation to first meaningful acknowledgment by a qualified engineer. Resolution time is defined as the time from ticket creation to confirmed restoration of service or acceptable workaround.

Priority is assigned by Constant Tech Systems based on business impact. Clients may request priority escalation; final determination rests with our engineering team based on objective impact criteria. For P1 incidents, our on-call engineer will provide status updates every 30 minutes until resolution.

05

Support Channels & Hours

Contact Methods

• Client Portal — support.constanttechsystems.com — ticket submission, status tracking, and documentation (24/7 access).
• Email — support@constanttechsystems.com — routed to the ticketing system automatically.
• Phone — (888) 984-9069 — staffed during business hours; after-hours calls to the emergency line are answered by on-call staff for P1/P2 incidents.
• Emergency Hotline — provided to Enterprise and HIPAA/EDI tier Clients in the onboarding package — for P1 issues only outside standard business hours.

Support Hours by Tier

"Business hours" means Monday through Friday, 8:00 AM to 5:00 PM Pacific Standard Time, excluding U.S. federal public holidays.

06

Scheduled Maintenance

Planned maintenance is necessary to apply security patches, perform hardware upgrades, and optimize infrastructure. We minimize its impact through the following commitments:

• Standard maintenance window — Saturdays, 12:00 AM – 4:00 AM PST, or as agreed with the Client in writing.
• Advance notice — at least 72 hours for routine maintenance; at least 5 business days for major upgrades expected to cause significant disruption.
• Emergency maintenance — may be performed with less than 72 hours' notice when required to address critical security vulnerabilities (e.g., zero-day exploits, ransomware threat mitigation). We will notify Clients as early as practicable.
• HIPAA / EDI tier — all maintenance windows must be pre-approved in writing by the Client's designated technical contact.

07

Service Credits

If Constant Tech Systems fails to meet the uptime commitment for a Covered Service in any calendar month, the Client is eligible to receive a service credit against future invoices according to the schedule below.

Credit Schedule

Credit Request Process

1. The Client must submit a credit request to support@constanttechsystems.com within fifteen (15) days following the end of the affected calendar month.
2. Requests must include the affected service name, the date and time of the outage(s), and any relevant ticket numbers.
3. We will review the request against our monitoring data and respond within ten (10) business days with a determination.
4. Approved credits will be applied to the next monthly invoice. Credits are non-refundable and non-transferable.

08

Exclusions

The following are excluded from uptime calculations and do not give rise to service credit eligibility ("Excused Downtime"):

• Scheduled maintenance — downtime during a pre-notified and approved maintenance window (Section 6).
• Force majeure — outages caused by events beyond our reasonable control, including natural disasters, acts of war, government action, pandemic, major internet backbone failures, or widespread cloud provider outages (AWS, Azure, GCP) affecting multiple unrelated customers simultaneously.
• Client-caused issues — outages or degradation resulting from the Client's own actions or inactions, including misconfiguration of Client-managed systems, failure to apply recommended patches within agreed timeframes, unauthorized access changes, or deliberate or accidental actions by the Client's staff.
• Third-party service failures — failures in third-party software, SaaS platforms, internet service providers, DNS providers, or utility providers not under our direct management and control.
• Denial-of-service attacks — service degradation caused by distributed denial-of-service (DDoS) or similar volumetric attacks that exceed the capacity of implemented mitigation controls, provided we are actively working to mitigate the attack.
• Suspension for non-payment — service suspension resulting from Client's failure to pay undisputed invoices in accordance with the Terms of Service.
• Beta or preview features — features explicitly designated as beta, preview, or pilot.

09

Client Obligations

To enable Constant Tech Systems to meet its SLA commitments, the Client agrees to:

• Designate at least one named technical contact with authority to make decisions on behalf of the Client regarding service incidents and maintenance approvals.
• Provide prompt access to systems, credentials, and personnel required to diagnose and resolve incidents.
• Notify us immediately upon becoming aware of any incident, anomaly, or potential security event that may affect the Covered Services.
• Apply vendor-issued security patches to Client-managed components within the timeframes specified in the applicable security patch policy (typically 30 days for critical patches, 90 days for high/medium).
• Maintain adequate network connectivity and power supply to Client-owned on-premises equipment under our management.
• Respond to requests for information or access during active P1/P2 incidents within 30 minutes during business hours and within 60 minutes outside business hours.
• For HIPAA/EDI tier Clients: maintain a current list of authorized personnel and immediately notify us of any personnel changes that affect system access.

Failure to meet these obligations may result in SLA commitments being paused during the period of non-compliance, and any resulting downtime during that period will be treated as Excused Downtime.

10

EDI & Healthcare-Specific SLAs

Clients on the HIPAA/EDI tier receive additional service level commitments specific to electronic data interchange and healthcare transaction processing.

EDI Transaction Processing

Data Integrity & Security

• All ePHI and EDI transaction data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Transaction audit logs are retained for a minimum of seven (7) years in compliance with HIPAA requirements.
• We maintain a tested Business Continuity and Disaster Recovery (BCDR) plan with an RTO (Recovery Time Objective) of 4 hours and RPO (Recovery Point Objective) of 1 hour for HIPAA/EDI tier Clients.
• Annual BCDR testing results are provided to Clients upon request.

Clearinghouse Connectivity

We maintain active connectivity agreements with major EDI clearinghouses. In the event a clearinghouse experiences an outage, we will: (a) notify affected Clients within 30 minutes of confirmed clearinghouse unavailability; (b) engage the clearinghouse's support team immediately; and (c) where feasible, route transactions through an alternate clearinghouse or direct payer connection until primary connectivity is restored.

11

Reporting & Review

Monthly SLA Reports

We provide each Client with a monthly SLA performance report within five (5) business days following the end of each calendar month. Reports include:

• Actual uptime percentage for each Covered Service.
• Total incident count by priority level, with response and resolution times.
• Scheduled maintenance activities performed.
• Any SLA breaches and the root cause analysis (RCA) for P1/P2 incidents.
• Open tickets carried over into the next period.
• For HIPAA/EDI tier: EDI transaction volume, error rates, and processing turnaround metrics.

Quarterly Business Reviews

Enterprise and HIPAA/EDI tier Clients are entitled to a Quarterly Business Review (QBR) meeting with their dedicated account manager and senior engineer. QBRs cover trend analysis, capacity planning, upcoming changes, and SLA performance over the trailing quarter.

Real-Time Dashboards

Enterprise and HIPAA/EDI tier Clients have access to a live monitoring dashboard via the Client Portal showing current system status, active alerts, and historical uptime data for all Covered Services.

12

Escalation Process

If the Client believes an incident is not receiving appropriate priority or that response times are not being met, the following escalation path is available:

1. Level 1 — Support Engineer
   Initial contact via portal, email, or phone. Handles all P3/P4 incidents and initial triage for P1/P2.
2. Level 2 — Senior Engineer / Team Lead
   Escalate via ticket update or phone if no meaningful progress within the target response window. Available for P1/P2 incidents at any time.
3. Level 3 — Account Manager
   Business-level escalation for unresolved P1/P2 incidents exceeding target resolution time, billing disputes, or SLA credit disagreements. Contact via accounts@constanttechsystems.com.
4. Level 4 — Executive Sponsor
   For active, business-critical P1 incidents unresolved for more than 8 hours, or for formal complaints. Contact information provided to Enterprise and HIPAA/EDI tier Clients in the onboarding package.

13

Amendments

Constant Tech Systems may update this SLA from time to time to reflect changes in our infrastructure, service capabilities, or industry standards. We will provide at least thirty (30) days' written notice of any material reduction in service level commitments. Non-material updates (e.g., clarifications, formatting changes, addition of new metrics that do not reduce existing commitments) may be made at any time with notice posted to the Client Portal.

If a Client objects to a material reduction, they must notify us in writing within 15 days of the notice. In the absence of objection, the updated SLA takes effect on the stated effective date. If a Client objects and the parties cannot reach agreement within 30 days, either party may terminate the affected Service Order with 30 days' written notice without early termination fees.

Any SLA commitments specific to a Client's environment that differ from this standard SLA must be documented in a signed SOW or MSA amendment to be enforceable.

14

Contact & Reporting

For incident reporting, SLA credit requests, or questions about this agreement:

This SLA is governed by and incorporated into the Terms of Service. For data protection obligations, see the Privacy Policy.