SLA Performance Metrics
| Field | Value |
|---|---|
| Version | 1.0 |
| Effective Date | April 2026 |
| Review Cycle | Annual |
| Document Owner | Chief Information Security Officer (CISO) |
| Classification | CONFIDENTIAL — Internal Use Only |
| Applicable Standard | SOC 2 Type II — Security, Availability, Confidentiality |
1. Purpose and Scope
This document defines the Service Level Agreements (SLAs) and performance metrics for QA Touch, covering availability commitments, response time targets, quality standards, and the metrics and monitoring mechanisms used to track compliance. Supports SOC 2 Availability criteria A1.2 (Monitoring of Availability) and A1.3 (Recovery from Availability Failures), and Processing Integrity PI1.5.
ASSUMPTION: All SLA values are illustrative. Confirm committed values with QA Touch leadership and legal teams. Customer-facing SLA commitments must be enshrined in the Terms of Service and customer contracts.
2. Service Availability SLAs
| Service Component | Availability Target | Measurement Period | Exclusions |
|---|---|---|---|
| QA Touch Web Application | 99.9% uptime | Monthly rolling | Planned maintenance, force majeure, customer-caused outages |
| REST API | 99.9% uptime | Monthly rolling | Same exclusions as web application |
| Webhook Delivery Service | 99.5% delivery success rate | Monthly rolling | Third-party endpoint failures outside QA Touch’s control |
| Email Notification Service | 99.5% delivery success rate | Monthly rolling | Recipient server rejections; spam filtering by recipient provider |
| Integration Sync Service | 99.5% successful sync rate | Monthly rolling | Third-party system (Jira, ADO) downtime |
| AI Generation Feature | 99.0% availability | Monthly rolling | Third-party LLM provider downtime; rate limits imposed by provider |
| Status Page | 99.99% uptime (separate CDN-hosted) | Monthly rolling | CDN provider outage |
3. Performance Metrics
| Metric | Target | Measurement Tool | Alert Threshold |
|---|---|---|---|
| API Response Time (p50) | < 200ms | APM (Datadog / CloudWatch [VERIFY]) | N/A |
| API Response Time (p95) | < 500ms | APM | Sustained > 1,000ms |
| API Response Time (p99) | < 1,000ms | APM | Sustained > 2,000ms |
| Page Load Time (p50) | < 2 seconds | Real User Monitoring (RUM) | Sustained > 5 seconds |
| HTTP 5xx Error Rate | < 0.1% | APM | Sustained > 1% |
| Database Query Time (p95) | < 100ms | Database metrics | Sustained > 500ms |
| AI Generation (p50) | < 10 seconds | Application metrics | Sustained > 30 seconds |
| Import Processing (1,000 rows) | < 60 seconds | Application metrics | Sustained > 300 seconds |
| Webhook Delivery (first attempt) | < 30 seconds | Webhook logs | Sustained > 2 minutes |
| Backup Completion | Daily by 06:00 UTC | Backup monitoring | Missed daily window |
| MTTR (P1 incidents) | < 4 hours | Incident management system | N/A — tracked for reporting |
| MTTD (P1 incidents) | < 15 minutes | Monitoring alerts | N/A — tracked for reporting |
4. Incident Priority Levels and Response SLAs
| P | Definition | Response SLA | Resolution SLA |
|---|---|---|---|
| P1 | Complete platform outage or data breach; all customers affected. | 15 minutes to acknowledge | 4 hours or escalate to incident declaration |
| P2 | Major feature unavailable; significant customer impact; no workaround. | 30 minutes | 8 hours |
| P3 | Minor feature degraded; workaround available; limited customer impact. | 2 hours | 48 hours |
| P4 | Cosmetic issue; no functional impact; single customer or edge case. | Next business day | Next scheduled release |
5. Business Continuity Metrics
| Metric | Target | Testing Frequency |
|---|---|---|
| Recovery Time Objective (RTO) | 4 hours | Annually via DR test |
| Recovery Point Objective (RPO) | 1 hour | Annually via DR test |
| Backup Restore Test | Successful full restore verified | Quarterly |
| Automated Failover Test | Successful failover within RTO | Annually |
6. SLA Reporting and Governance
- Real-time uptime and availability metrics published on the public QA Touch Status Page [VERIFY URL].
- Monthly uptime reports produced; shared with enterprise customers on request.
- SLA compliance reviewed quarterly by Engineering and Operations leadership.
- SLA credits (if applicable) governed by Terms of Service credit terms [VERIFY].
- Historical incident records and MTTR data maintained for SOC 2 A1 audit evidence.