Hosting service level agreement

This service level agreement ("SLA") is between Northbrik Systems Ltd, a company incorporated in England and Wales with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ ("Northbrik", "we", "us"), and the client organisation that has subscribed to a Hosted, Maintained or Managed hosting plan ("Client", "you").

This SLA applies only to services delivered under a Northbrik hosting plan and takes effect on the date the hosting plan becomes active. It forms part of the overall service agreement between the parties. In the event of conflict, the order of precedence set out in the service agreement applies.

If you are a software-development client but have not subscribed to a hosting plan, this SLA does not apply. Your deliverables are governed by the service agreement and any signed statement of work.

Covered service

The website or web application deployed on Northbrik infrastructure under the active hosting plan.

Downtime

A period during which the covered service returns HTTP error responses (5xx) or is unreachable from our monitoring infrastructure for two or more consecutive checks, each 60 seconds apart. Downtime does not include scheduled maintenance windows.

Uptime percentage

((Total minutes in calendar month − Downtime minutes) ÷ Total minutes in calendar month) × 100, rounded to two decimal places.

Incident

Any unplanned event that causes or risks causing Downtime, data loss, a security breach, or material degradation of service performance.

Response time

The time between Northbrik first being notified of (or detecting) an Incident and Northbrik acknowledging it in writing to the Client.

Resolution time

The time between Northbrik first being notified of an Incident and the covered service returning to normal operation.

Maintenance window

A scheduled period during which the covered service may be temporarily unavailable for planned infrastructure work.

Service credit

A monetary credit applied to the Client's next invoice, calculated as a percentage of the affected month's hosting fee.

UK business hours

09:00–18:00 Monday to Friday, excluding UK public holidays.

Northbrik targets 99.9% uptime per calendar month for all covered services across all hosting plans. This equates to a maximum permissible Downtime of approximately 43.8 minutes per calendar month.

Uptime is measured using synthetic monitoring checks run every 60 seconds from at least two UK-based locations. A Downtime period is recorded only when two consecutive checks from the same location both fail, to eliminate transient false positives.

Service credits

Where the monthly uptime percentage falls below the target, the Client is entitled to a service credit applied to the following month's invoice:

99.9% – 99.0%

10% credit of the affected month's hosting fee.

98.9% – 95.0%

20% credit of the affected month's hosting fee.

Below 95.0%

40% credit of the affected month's hosting fee.

Service credits are the Client's sole and exclusive financial remedy for availability shortfall. Credits are not redeemable for cash and cannot exceed the hosting fee paid in the affected month. Credits do not apply where Downtime results from an Excluded cause (see section 7).

To claim a credit, the Client must submit a written request to hello@northbrik.com within 14 calendar days of the end of the affected month, referencing the Incident and the period of Downtime. Northbrik will review the request and respond within 5 UK business days.

Incidents are classified into three priority levels. Response and target resolution times vary by plan.

Priority 1 — Critical

The covered service is completely unavailable or a confirmed security breach is in progress. All data is at risk.

Hosted

Response: 4 UK business hours. Resolution target: next UK business day.

Maintained

Response: 4 UK business hours. Resolution target: 8 UK business hours.

Managed

Response: 2 hours (7 days a week, including weekends and public holidays). Resolution target: 4 hours.

Priority 2 — Major

Core functionality is impaired; the service is partially unavailable or severely degraded. A workaround may exist but is not suitable for normal operations.

Hosted

Response: next UK business day. Resolution target: 3 UK business days.

Maintained

Response: 1 UK business day. Resolution target: 2 UK business days.

Managed

Response: 4 hours. Resolution target: 1 UK business day.

Priority 3 — Minor

Non-critical issue, degraded performance, or a question about the hosting environment. The service remains usable.

Hosted

Response: 2 UK business days. Resolution target: 5 UK business days.

Maintained

Response: 1 UK business day. Resolution target: 3 UK business days.

Managed

Response: 4 UK business hours. Resolution target: 2 UK business days.

Northbrik monitors the covered service continuously and will open a Priority 1 Incident ticket automatically on detection of Downtime. You do not need to wait to be alerted before contacting us. For urgent issues outside UK business hours, Managed plan clients should use the dedicated Slack or WhatsApp channel agreed at onboarding.

Northbrik reserves the right to carry out planned maintenance that may cause brief service interruptions. Planned maintenance does not count towards Downtime for the purpose of the availability commitment or service credits.

The following conditions apply to all planned maintenance:

• Northbrik will give at least 48 hours' written notice before any planned maintenance that is expected to cause service interruption.
• Maintenance is normally scheduled between 22:00 and 06:00 UK time on a Sunday morning.
• Emergency maintenance to address an active security vulnerability or critical infrastructure failure may be carried out with shorter notice. Northbrik will notify the Client as soon as practicable and provide a summary of the work completed.
• We aim to complete planned maintenance within the notified window. If work overruns, we will provide an updated estimate.

Northbrik takes automated backups of all covered services as follows:

Frequency

Daily, taken between 01:00 and 04:00 UK time.

Retention

30 rolling days. Backups older than 30 days are deleted automatically.

Storage

Off-site, on infrastructure physically separate from the primary hosting environment.

Scope

Application files, any database managed by Northbrik under the hosting plan, and environment configuration (excluding secrets).

Restore requests must be submitted in writing to hello@northbrik.com. Northbrik will acknowledge the request within one UK business day and complete the restore within two UK business days. For Managed plan clients, a restore can be initiated via the dedicated support channel and will be acknowledged within 2 hours.

Backups are provided as a safeguard against data loss arising from infrastructure failure or operational error. They are not a substitute for the Client maintaining its own copies of important data. Northbrik does not guarantee that any particular backup will be free of corruption; restoration is performed on a best-efforts basis.

Clients on the static Hosted plan whose site has no server-side database will have file-system backups only. If you are unsure what your backup covers, email hello@northbrik.com.

The availability commitment, incident response targets and service credits do not apply where Downtime or degradation arises from:

• Scheduled maintenance windows notified in accordance with section 5.
• Failures in the Client's own systems, third-party integrations, or services not operated by Northbrik (including DNS registrars, CDN providers, payment processors, and Supabase or other SaaS databases not under our direct control).
• Actions taken by the Client or a third party authorised by the Client, including code deployments initiated by the Client outside of the agreed deployment process.
• Force majeure events: circumstances beyond Northbrik's reasonable control, including acts of God, civil unrest, government action, pandemic, widespread internet infrastructure failure, or acts of a national telecommunications authority.
• DDoS attacks or other hostile network activity of a scale that exceeds the capacity of standard volumetric mitigation.
• The Client's failure to make payment when due, where Northbrik has given 7 days' written notice of suspension.
• Events arising from software not written or deployed by Northbrik (for example, a vulnerability in a CMS theme or plugin installed directly by the Client).

Northbrik is responsible for:

• Operating system patching on the monthly cycle described on the hosting page, with critical CVEs (CVSS 7.0+) patched within 48 hours.
• Provisioning and renewing SSL/TLS certificates.
• Maintaining firewall rules and security headers on the nginx layer.
• Monitoring server access logs for anomalous patterns.
• Notifying the Client within 72 hours of becoming aware of a confirmed personal-data breach affecting the covered service, in accordance with UK GDPR Article 33.

The Client is responsible for:

• The security of application-level code not reviewed or written by Northbrik.
• Keeping any third-party packages or CMS plugins up to date where the Client manages them directly.
• Safeguarding credentials (API keys, database passwords) issued to the Client.
• Informing Northbrik promptly of any suspected security incident or unauthorised access.

Northbrik will provide the following reports and communications during the term of the hosting plan:

Incident notifications

Email notification within 5 minutes of a confirmed Priority 1 Incident being detected by our monitoring system.

Incident closure

Written summary of the cause, resolution, and any remedial action taken, sent within 2 UK business days of resolution.

Maintained plan monthly report

A brief written report sent by the 5th of each month covering: uptime in the preceding month, maintenance activity, packages updated, and any issues found and resolved.

Managed plan monthly review

A 30-minute call or video meeting scheduled on a mutually agreed date each month, covering the monthly report content plus infrastructure and roadmap discussion.

Nothing in this SLA limits or excludes Northbrik's liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be excluded or limited under English law.

Subject to the above, Northbrik's total liability to the Client in connection with this SLA in any 12-month period is limited to the total hosting fees paid by the Client in that period.

Northbrik is not liable for any indirect, consequential, special or punitive loss, including loss of profits, revenue, goodwill, data or business opportunity, whether arising in contract, tort (including negligence), or otherwise, even if Northbrik has been advised of the possibility of such loss.

Service credits are the Client's sole financial remedy for availability shortfall and do not limit Northbrik's liability in respect of other Incidents or other terms of the service agreement.

This SLA is effective from the date the hosting plan becomes active and continues for as long as the hosting plan is in force.

Northbrik may amend this SLA by giving 30 days' written notice to the Client. If the Client objects to the amended terms, the Client may terminate the hosting plan on the notice period set out in the service agreement without early-termination penalty, provided notice is given before the amended SLA takes effect.

This SLA terminates automatically on the termination or expiry of the hosting plan. Outstanding service credit claims made before termination will be processed against the final invoice.