Guaranteed Performance, Availability & Support Commitments

Service Level Agreement (SLA) Policy

Last Updated: Dec 01, 2025

Legal Entity: Xotiv Technologies Pvt Ltd

Corporate Address: A-152, Sector-63, Noida, Uttar Pradesh – 201301, India

Contact: privacy@xotiv.com

Introduction

This Service Level Agreement (SLA) Policy outlines the performance commitments, support framework, service availability targets, escalation process, and responsibilities that govern all IT consulting, software development, staff augmentation, cloud, DevOps, managed services, and digital delivery engagements provided by Xotiv Technologies Pvt Ltd (“Xotiv,” “we,” “our,” “us”).

This SLA Policy is designed to set clear expectations, reinforce operational transparency, and ensure consistent delivery excellence across all client engagements. It applies to all Clients who have executed a Master Services Agreement (MSA), Statement of Work (SOW), or Project Contract with Xotiv.

This document follows global industry standards used by enterprise consulting firms and is compliant with:

• SOC 2 Trust Principles (Availability, Security, Integrity)
• ISO 27001 Information Security Management
• GDPR requirements for data processing accountability
• HIPAA readiness for healthcare clients
• ITIL v4 Service Delivery Framework

Scope of the SLA

This SLA applies to the following service categories delivered by Xotiv:

• Custom Software Development
• Web & Mobile Application Development
• Enterprise Application Development
• Cloud, DevOps & Infrastructure Services
• Salesforce & CRM Implementations
• Data Engineering, BI & Analytics Services
• Staff Augmentation & Dedicated Teams
• Managed Support & Maintenance Services
• Ongoing Enhancements, Upgrades & Optimization

If a specific SOW contains custom SLA commitments, those terms override general sections of this policy.

Definitions

Service Availability The percentage of time the service is accessible and operational in a production environment.

Incident Any unplanned interruption affecting service performance or availability.

Severity Levels (P1–P4) Categorization of incidents based on business impact.

Response Time The time taken for Xotiv to acknowledge the incident.

Resolution Time The time within which Xotiv aims to resolve an incident.

Business Hours 9:00 AM – 6:00 PM (IST/EST/Client timezone as defined in the SOW), excluding weekends and national holidays unless otherwise contracted.

24×7 Support Provided only if included in the contract.

Service Availability Targets

For Managed Services, Cloud, DevOps, and critical applications, Xotiv targets:

Service Tier	Availability
Enterprise Tier	99.5% uptime
Standard Tier	98.5% uptime
Basic Tier	95.0% uptime

Availability excludes:

• Scheduled maintenance
• Emergency maintenance
• Client-side issues (hosting, DNS, firewall, or infra not managed by Xotiv)
• Third-party outages (cloud providers, SaaS tools, APIs, payment gateways)
• Force majeure events

Severity Classification

All issues logged by the Client are triaged into the severity levels below:

Priority 1 (Critical – P1)

Complete outage or major system failure affecting all users.

Examples:

• Production downtime
• Security breach or vulnerability
• Core features non-functional
• Data corruption

Response: 30 minutes

Target Resolution: 4–8 hours

Priority 2 (High – P2)

Major functionality degraded but system is partially operational.

Examples:

• Performance degradation
• API delays or errors
• Non-critical components failing

Response: 1 hour

Target Resolution: 12–24 hours

Priority 3 (Medium – P3)

Non-critical issues affecting some users.

Examples:

• UI alignment issues
• Minor bugs
• Config changes

Response: 4 hours

Target Resolution: 2–4 business days

Priority 4 (Low – P4)

Enhancement requests, optimizations, non-urgent changes.

Examples:

• Feature extensions
• Reports, dashboards
• Minor improvements

Response: 1 business day

Estimated Delivery: Based on backlog planning

Support Coverage

Support coverage depends on the engagement model:

Engagement Type	Coverage
Offshore Development Team	Business Hours IST
Dedicated Staff Augmentation	Aligned with Client Timezone
Managed Support	24×5 or 24×7 (as per contract)
Project-Based Development	Business Hours IST

Critical Infra/DevOps

24×7 (if included in SOW)

Clients may upgrade support tiers anytime through contractual addendums.

Communication Channels

Clients may report issues via:

• Dedicated Support Portal / Ticketing System
• Email Support
• Slack / Teams (if enabled)
• Phone Support (for P1/P2)
• Assigned Delivery Manager and Project Manager

All communication is tracked for SLA compliance and audit logs.

Incident Management Process

The Xotiv incident response framework includes:

1. Ticket Logging & Acknowledgment
2. Severity Assignment & Initial Assessment
3. Incident Ownership & Assignment
4. Root Cause Analysis (RCA)
5. Fix Delivery & Validation
6. Post-Incident Review & Closure

For P1 incidents, a war-room approach is immediately activated involving engineering, QA, DevOps, and leadership.

Scheduled & Emergency Maintenance

Scheduled Maintenance

Performed during low-traffic hours with prior notice of:

• 48 hours for standard updates
• 7 days for major maintenance
• 14 days for infrastructure migrations

Emergency Maintenance

Executed without notice when required to mitigate:

• Security threats
• System vulnerabilities
• Critical performance issues

Xotiv ensures minimal disruption and immediate post-update communication.

Change Management

Xotiv follows a strict ITIL v4–aligned change management process:

• Impact assessment
• Risk assessment
• Client approval
• Testing & staging
• Deployment
• Validation
• Documentation

Urgent changes may be deployed immediately with verbal/written approval and post-change documentation.

Backups & Disaster Recovery

For managed hosting environments controlled by Xotiv:

• Daily automated backups (retention: 7–30 days depending on tier)
• Weekly full backups
• Encrypted backups stored offsite
• Disaster recovery plan aligned with RTO/RPO agreements

Typical standards:

Tier	RTO	RPO
Enterprise	1–4 hours	15–60 minutes
Standard	4–12 hours	2–4 hours
Basic	24 hours	24 hours

Performance Metrics & Benchmarks

Xotiv ensures:

• Optimal page load speed
• API latency within acceptable thresholds
• Database query optimization
• Stable infrastructure utilization
• Scalable architecture for traffic peaks

Clients may request quarterly performance audits.

Client Responsibilities

Clients agree to:

• Provide timely access to systems, environments, and resources
• Supply accurate requirements and documentation
• Maintain their internal infrastructure (if self-managed)
• Ensure timely approvals and feedback
• Notify Xotiv immediately of critical incidents

Delays or gaps in these areas may affect SLA timelines.

Exclusions

SLA commitments do not apply to issues arising from:

• Third-party outages
• Client-side hosting issues
• Force majeure events
• Unsupported technology stacks
• Unauthorized modifications made by Client or third parties
• Beta or experimental features
• Hardware failures not managed by Xotiv

Escalation Matrix

Xotiv provides a structured escalation pathway:

1. Level 1 – Support Engineer
2. Level 2 – Technical Lead / DevOps Lead
3. Level 3 – Delivery Manager / Project Manager
4. Level 4 – Director of Delivery / CTO

24×7 escalation applies only for contracted 24×7 support.

Service Credits

If Xotiv fails to meet contractual SLA availability, Clients may receive service credits, applied as a percentage of monthly service fees. Typical structure (customizable in SOW):

Uptime	Credit
<99.5%	5%
<98%	10%
<95%	15%
<90%	25%

Service credits are not monetary refunds; they apply to future invoices.

---

Compliance & Security Commitments

Xotiv maintains rigorous security protocols:

• SOC 2–aligned controls
• ISO 27001 principles
• GDPR-compliant data handling
• HIPAA adherence for healthcare clients
• Data encryption (AES-256 at rest, TLS 1.2+ in transit)
• Access control & MFA enforcement
• SIEM monitoring
• Vulnerability scanning & periodic penetration testing

Security incidents follow a dedicated breach-response protocol.

---

Data Protection Alignment

Under GDPR and global privacy laws, Xotiv ensures:

• Lawful data processing
• Data minimization
• Purpose limitation
• Secure data retention
• Right to access, rectify, delete
• Data transfer safeguards (SCCs, DPAs)

Clients may request a Data Processing Addendum (DPA).

---

Policy Updates

Xotiv may periodically update this SLA Policy due to:

• Regulatory changes
• New services
• Infrastructure upgrades
• Internal improvements

Revised versions will carry an updated “Last Updated” date.

---

Contact & Support

For SLA questions or service issues:

Xotiv Technologies Pvt Ltd

A-152, Sector-63 Noida, Uttar Pradesh – 201301, India

Email: privacy@xotiv.com