Service Level Agreement for BindID™

Transmit Security will use commercially reasonable efforts to make BindID™ available. As BindID™ is offered uniformly across all customers, the SLA cannot be modified on a customer-by-customer basis.  The following SLA is only for BindID™ enterprise subscription and excludes non-Enterprise BindID, FlexID,WorkID and any other Transmit Security products and subscriptions.

Capitalized terms herein shall have the same meaning as defined in the End User License Agreement for BindID™ and any applicable Schedule or Order executed by and between Transmit Security and the Customer (the “Agreement”).

1. Hours of Operation. BindID™ is designed to be available 24 hours a day, 7 days a week, 365 days a year, except during maintenance periods, technology upgrades, and as otherwise set forth in this SLA.

2. BindID™ Availability.

2.1. Commencing on Transmit Security’s activation of the BindID™ to Customer, Transmit Security strives to meet the “Target Service Availability”, or “Target Service Uptime” of 99.95%.

2.2. The foregoing is contingent on the Customer’s adherence to Transmit Security’s recommended minimum technical configuration requirements for accessing and using BindID™ from Customer’s network infrastructure.

3. Measurement of Availability.

Following the end of each calendar month of the applicable Schedule Term, Transmit Security measures the service availability of the BindID™ over the immediately preceding month by dividing the difference between the total number of minutes in the monthly measurement period and any Unplanned Downtime (as further defined below) by the total number of minutes in the measurement period, and multiplying the result by 100 to reach a percent figure.

BindID™ is considered available in the following scenarios:

1. Administrators are able to login to the admin portal and make any settings changes in it.

2. The service is able to process user authentication requests.

4. Definition of Unplanned Downtime.

4.1. BindID™ is deployed in resilient computing facilities with resilient infrastructure, redundant network connections, and power at each hosting facility.

4.2. “Unplanned Downtime” means any time during which an issue with the service prevents the Customer’s connectivity. Unplanned Downtime does not include any time during which BindID, or any component thereof, are not available due to the following:

4.2.1. maintenance periods (as further discussed below);

4.2.2. circumstances outside of Transmit Security’s control or other Force Majeure events;

4.2.3. any actions or inactions by the Customer or its users (e.g., restarting, stopping, filling up storage, misconfiguring database parameters, installation of third-party agents/software, misconfiguration of security groups, VCN configurations or credential settings, disabling encryption keys or making the encryption keys inaccessible, not allocating adequate resources for Customer’s workload or exceeding limits specified for the BindID™ Service, third party malicious acts against Customer or its users, etc.); or

4.2.4. any suspension by Transmit Security permitted under the Agreement.

Claims. Customers must submit a claim within 60 days of the end of the contracted month that the service level was missed. Credits cannot exceed 50% of monthly charge.

Exclusions. No credits are given for failure to meet an SLA because of:

➢ Beta, trial, experimental, or no-charge subscription..
➢ Customer infrastructure failures, including network, hardware, facility, or power.
➢ Customer errors or failures to provide needed information or access to resolve an outage.
➢ Customer-caused security incidents or security testing.
➢ Any exclusions set forth in Section 4.2.
➢ Other causes beyond Transmit Security’s reasonable control.

6. BindID™ Change Management Policy

6.1. BindID™ Change Management and Maintenance

The Transmit Security Operations team performs changes to cloud hardware infrastructure, operating software, product software, and supporting application software that is provided by Transmit Security as part of the BindID™ service to maintain operational stability, availability, security, and performance of the service. Transmit Security follows formal change management procedures to review, test, and approve changes prior to application in the production service.

Changes made through change management procedures include system and service maintenance activities, upgrades and updates, and customer-specific changes. Transmit Security’s change management procedures are designed to minimize service interruptions during the implementation of changes.

6.2. Emergency Maintenance

Transmit Security may be required to execute emergency maintenance in order to protect the security, performance, availability, or stability of the BindID. Emergency maintenance is required to address an exigent situation that cannot be addressed except on an emergency basis.

7. BindID™ Support Policy

7.1. Severity Level Guidelines and Response Time Objectives

Level 1: Critical business impact/Service Down. Business critical functionality is inoperable or critical interface has failed. This usually applies to a production environment and indicates an inability to access the service resulting in a critical impact on operations. This condition requires an immediate solution. The Customer must log a Service Down within 24 hours of first becoming aware that there is a critical business impact and the service is not available. Please Note: Telephone call must follow the opening of a ticket. Transmit Security will work with the Customer 24 hours a day, seven days a week to resolve critical problems provided the Customer has a technical resource available to work during those hours and Customer must reasonably assist Transmit Security with any problem diagnosis and resolution.

Level 2: Significant business impact. A service, business feature, or function of BindID™ is severely restricted in its use.

Level 3: Minor business impact. The service or functionality is usable and the issue can be worked around without significant inconvenience.

Level 4: Minimal business impact. An inquiry, non-technical request or general questions.

7.2. Response Time Objectives & Coverage

The following table outlines response time objectives that Transmit Security strives to achieve, measured from the time Transmit Security receives the Customer’s initial request for support to the time Transmit Security provides an initial communication back to the Customer regarding its request.

*Please note: Response time objectives described in this SLA are intended to describe Transmit Security’s goals, only and do not represent a guarantee of performance.

8. Non-Enterprise subscriptions

None of the above mentioned terms is assured to be honored in the case of non-Enterprise subscriptions, this includes free trial (“Evaluation”) subscription and any other non-Enterprise BindID™ subscription to be introduced in the future by Transmit Security.

9. Contact Information and Escalation Process

10. Support Terms and Details

10.1 Transmit Security will be solely responsible for categorizing incidents; however, the Customer may request to re-categorize the incident.

10.2 The Customer must contact the Transmit Security Technical Support number immediately after opening a Level 1 online ticket in order to facilitate an emergency response.

10.3 In a timely and expedient manner, Customer agrees to: (i) provide Transmit Security with reasonable detail of the nature of and circumstances surrounding an error, (ii) confirm that Transmit Security has received complete requested logs of products, and (iii) provide Transmit Security with reasonable access to Customer’s environment, as necessary, to enable Transmit Security to provide support.

10.4 Customer acknowledges and agrees that Transmit Security may not have a satisfactory response, or that response timelines may be significantly delayed due to Customer’s inability to produce relevant requested information about error, or Customer’s inability to respond to Transmit Security’s requests in general.

10.5 Transmit Security must be able to reproduce reported error with given information, and that error must be determinable and reproducible to resolve the issue with either a work-around or a fix.

10.6 Any security vulnerability which allows for access to data or allows for service down-time will be treated on a priority basis. The goal delivery time for a maintenance release fix is 24-48 hours, otherwise the fix will be included in the next version.

10.7 If the problem is diagnosed to be something other than the Transmit Security platform, then the reported issue will exit the Transmit Security escalation process and will be considered resolved.

10.8 Transmit Security has no obligation to provide any support to Customer: (i) for any software, hardware or other element of the Customer environment not provided by Transmit Security, (ii) if Customer or a third party has altered or modified any portion of the service, or (iii) if Customer has not used the service in accordance with Documentation or instructions provided by Transmit Security, including failure to follow implementation procedures.

10.9 Customer agrees that Transmit Security is not responsible for the support of (i) the externally connected databases except for Transmit Security policies and configurations, (ii) any third-party system or API connected to the Transmit Security platform provided by another vendor, (iii) the underlying operating system unless there are conflicts with the Transmit Security platform, (iv) any network connectivity on the Customer’s premises, involving mobile device communication over a mobile network, or the Internet, (v) any firewall or networking devices that may be blocking communication between platform components due to no fault of Transmit Security.

10.10 Support is only available in the English language.

10.11 Transmit Security platform includes phone and web support for teams of up to 5 (five) Customer team members.