Service Level Agreement

This Service Level Agreement ("SLA") sets out Didit's availability commitments for the Services and the service credits available if Didit misses them. For Enterprise customers, the operational metrics signed in the Order Form prevail over this SLA where the Order Form differs.

1. Scope

This SLA applies to:

• the Didit verification APIs at `api.didit.me`;
• the Business Console at `business.didit.me`; and
• the SDK endpoints directly operated by Didit.

Third-party services (for example, network providers, cloud providers, sub-processors) are out of scope to the extent the disruption is attributable to the third party and not to Didit's selection or management.

2. Availability commitment

Didit commits to maintain a monthly uptime of:

The live status page is at status.didit.me.

3. Uptime measurement

Uptime is measured minute by minute using Didit's internal monitoring tools. "Downtime" is any minute during which the core API or Business Console fails to respond successfully (HTTP 2XX/3XX) to an HTTPS request, as detected by Didit's monitoring system or reported and validated by a Client support alert.

Monthly Uptime is calculated as:

`Monthly Uptime (%) = ((Total minutes in month − Downtime minutes) / Total minutes in month) × 100`

4. Exclusions

The Monthly Uptime calculation excludes downtime resulting from:

• Force majeure — events beyond Didit's reasonable control.
• Scheduled maintenance — planned maintenance windows. Didit will limit scheduled maintenance to a maximum of five (5) hours per month and will give at least forty-eight (48) hours' prior notice via the Business Console or email.
• Urgent maintenance — unscheduled maintenance required to resolve critical security or performance issues. Didit will give reasonable prior notice where possible.
• Factors beyond Didit's reasonable control — Client-side hardware or software issues, internet network outages, denial-of-service attacks exceeding standard mitigation thresholds, or failures of third-party services (cloud providers, telcos, sub-processors) unless gross negligence by Didit in their selection or management is demonstrated.
• Acts or omissions of the Client or its Authorized Users, including any breach of the Master Services Agreement or Business Terms.

5. Service credits

If Didit fails to meet the Monthly Uptime commitment in Section 2, the Client may request a credit (in non-refundable Didit Credits) calculated on the Client's spend during the affected month:

5.1 Claim process. The Client must submit a written claim to billing@didit.me within thirty (30) calendar days after the end of the affected month, including the date and time of the incident and a brief description.

5.2 Sole and exclusive remedy. The service credit in this Section 5 is the Client's sole and exclusive remedy for any failure by Didit to meet the Monthly Uptime commitment under this SLA. The credit is applied to the next billing cycle or Credit replenishment.

6. Incident response and communication

• Public status page. Every production incident is posted at status.didit.me in real time, with regular updates and a post-mortem within fifteen (15) business days of resolution.
• Personal data breach notification. Didit notifies affected Clients without undue delay and in any case in time to allow the Client to meet its own 72-hour notification obligation under GDPR Article 33.
• Enterprise support. Enterprise Clients receive a named engineer on call 24x7 and a dedicated communication channel (Slack or WhatsApp), as set out in the Order Form.

7. Changes to this SLA

Didit may update this SLA from time to time on thirty (30) days' notice. The effective date at the top reflects the last refresh. For Enterprise Clients, the SLA committed in the Order Form remains in force for the duration of the Order Form term.

8. Contact

• Service credit claims: billing@didit.me
• Incident communications and 24x7 support: support@didit.me
• Status page: status.didit.me
• Legal: legal@didit.me