Performance of the Service

1. Availability

   Reciprocity will use commercially reasonable efforts to ensure that, other than for scheduled or emergency maintenance, the Service will be accessible in all material respects at least 99.9% of the time during any 30-day period, except as provided for below. The availability of the Service may be subject to limitations, delays, and other problems inherent to the general use of the Internet and other public networks or caused by Customer or third parties. Reciprocity is not responsible for any delays or other damage resulting from problems outside of Reciprocity’s control, including problems with the Service.

   Availability will be calculated on a monthly basis as follows:

   $$\underset{}{\overset{}{[(}}\frac{\mathrm{total}–\mathrm{nonexcluded}–\mathrm{excluded}}{\mathrm{total}–\mathrm{excluded}}\underset{}{\overset{}{)*100]=99.9\%}}$$

   Where:

   • total means the total number of minutes in a calendar month;
   • non-excluded means downtime that is not excluded; and
   • excluded means:

   Any unavailability caused by circumstances beyond Reciprocity’s reasonable control, including, without limitation, acts of God, acts of government, flood, fire, earthquakes, civil unrest, acts of terror, strikes or other labor problems (other than those involving Reciprocity’s employees), or third-party Internet service provider failures or delays (other than those Internet service providers under contract with Reciprocity).

2. Performance Issue Corrections

   If the Service is not accessible as specified in Section 1 of this SLA, Reciprocity will use commercially reasonable efforts to resolve such failure (“Performance Issue”) with a level of effort commensurate with the severity of the Performance Issue as set forth below. Reciprocity and Customer will comply with the following resolution procedures for all Performance Issues reported by Customer:

   1. Notice of Performance Issue. If Customer encounters a Performance Issue, Customer must describe the Performance Issue in a reasonably detailed written notice to Reciprocity by sending an email to [email protected]. After receipt of written notice of a Performance Issue from Customer, Reciprocity will notify Customer if Reciprocity cannot identify the cause of the Performance Issue. If Reciprocity cannot identify the cause of the Performance Issue, Customer will provide additional information regarding the Performance Issue as Reciprocity may request in order to assist Reciprocity with identifying the cause of the Performance Issue. Customer will provide a separate written notice for each Performance Issue encountered by Customer.
   2. Performance Issue Classification. In its notice of a Performance Issue, Customer will also classify the priority of the Performance Issue; such classification must be reasonable given the nature of the Performance Issue, Customer’s business situation and the Impact Severity Table below. To the extent that Reciprocity disagrees with any Performance Issue classification provided by Customer, Reciprocity will promptly advise Customer of the revised classification.
   3. Response Time. Reciprocity will use reasonable efforts to respond to each of Customer’s written notices of Performance Issue within the period set forth in Impact Severity Table below. The response time described in the Impact Severity Table is the time that has elapsed between Customer’s first notification of the Performance Issue as required above and the provision of a plan for resolution by a member of Reciprocity’s Support Services team.
   4. Expedited Response Time. If Customer requests that Reciprocity respond to its written notice of a Performance Issue within a time period other than as stated below, Customer may request such response, and Reciprocity may elect to fulfil such request in accordance with terms the parties agree to in writing; such terms may include, without limitation, additional costs and expenses payable by Customer to Reciprocity. Notwithstanding the foregoing, Reciprocity will have no obligation to enter into any such agreement with respect to any additional or expedited services. If the parties enter into any such agreement that includes additional costs or expenses, Reciprocity will invoice Customer for, and Customer will pay, such amounts as set forth in the Agreement before the agreed-upon Support Services are provided.

   Recovery Objectives

   Product	Recovery Point Objective (RPO)	Recovery Time Objective (RTO)
   ZenGRC Platform	4 hours	24 hours
   ROAR Platform	24 hours	24 hours

   Impact Severity

   Severity Classification	Description of Performance Issue	Response Time
   Severity 1	Your affected product is unavailable or completely unusable. A product server or cluster in production is not available, or is otherwise unusable.	4 hours
   Severity 2	The affected product is Highly Degraded. Significant Business Impact. Important product features are unavailable or extremely slowed, with no acceptable workaround. Implementation or production use of product is continuing; however, there is a serious impact on productivity. Example: CI Builds are erroring and not completing successfully, and the software release process is significantly affected.	8 hours
   Severity 3	Something is preventing normal product operation. Some Business Impact. Important product features are unavailable or somewhat slowed, but a workaround is available. Product use has a minor loss of operational functionality, regardless of the environment or usage. Example: A known bug impacts the use of product, but a workaround is successfully being used as a temporary solution.	12 hours
   Severity 4	Questions or Clarifications around features or documentation or deployments (72 hours) Minimal or no Business Impact. Information, an enhancement, or documentation clarification is requested, but there is no impact on the operation of product. Implementation or production use of product is continuing and work is not impeded.	72 hours

3. Customer Obligations

   Customer will provide Reciprocity with reasonable access to all necessary personnel to answer questions regarding Performance Issues reported by Customer. The provision of the Support Services by Reciprocity is contingent upon Customer’s performance of its payment and other obligations under the Agreement. Reciprocity reserves the right, in addition to other remedies available, to suspend its provision of the Support Services for so long as Customer is not current with its obligations.

4. Habitual Failure

   If the Service is Available on an average of less than 99.9% for three (3) consecutive months in any rolling six (6) month period, then Customer may immediately terminate this Agreement and any outstanding Order Form(s) upon written notice to Reciprocity, and receive a pro-rata refund for all unused, prepaid Fees from the date of such termination.

5. Reciprocity Support Service Levels

   Standard Support

   Standard Support is included with all subscriptions to the Service. Standard Support includes ‘Next business day support’ which means that you can expect a reply to your support ticket within 24 hours Monday through Friday, 8AM to 5PM PST.

   Support requests should be submitted through email to [email protected]. All support is provided in English and only English will be accepted in support tickets. Support tickets that are not provided in English will be discarded without response. Customer will also comply with Reciprocity’s Documentation regarding Support Services, which can be found at reciprocity.com/acceptableuse.

   Phone and Video Call Support

   Reciprocity does not offer support via inbound or on-demand calls.
   Reciprocity support engineers (“Engineers”) communicate with you about support requests primarily through updates in the support tickets themselves. At times, it may be useful and important to conduct a call, video call, or screen sharing session with you to improve the progress of a ticket. The Engineer may suggest a call for that reason. You may also request a call if you feel one is needed. The decision to conduct a call always rests with the Engineer, who will determine:

   • whether a call is necessary; and
   • whether we have sufficient information for a successful call.

   Once the decision has been made to schedule a call, the Engineer will:

   1. Send you a link (through the ticket) to our scheduling platform or a direct link to start the call.
   2. Update you through the ticket with: (a) an agenda and purpose for the call, (b) a list of any actions that must be taken to prepare for the call, and (c) the maximum time allowed for the call. The call will end as soon as the stated purpose has been achieved or the time limit has been reached, whichever occurs first.

   During a screen sharing session, Engineers will act as advisors: providing troubleshooting steps and inviting you to run commands to help gather data or help resolve technical issues. At no time will an Engineer ask to take control of your computer or to be granted direct access to your account in the Service.