Service Level Agreement

1. Overview

This Service Level Agreement (“SLA”) is the public summary of the operational service standards TRM Flex Limited applies to the TRM Flex platform. It describes our availability target, support response targets, planned maintenance practice and incident communication commitments. It supplements (and does not replace) the contract under which the platform is provided to you.

Higher service commitments, financial service credits or named-account support may be agreed in a separate written enterprise contract. Where such a contract exists and conflicts with this public summary, the contract prevails.

2. Availability target

We target 99.5% monthly uptime for the public production platform, measured as the percentage of minutes in a calendar month during which the core authenticated platform is reachable and able to serve a successful HTTP response from at least one healthy region.

The following are excluded from availability calculations:

scheduled maintenance windows announced in advance under section 4;
emergency maintenance required to address a security vulnerability or active incident;
downtime caused by your equipment, your network, or third-party services we do not control (e.g. your DNS provider, your ISP);
downtime caused by force majeure events;
suspension of your account due to non-payment, breach of the Acceptable Use Policy, or lawful request from a regulator or court.

3. Support response targets

Support is provided in English, by email, during UK business hours (09:00–17:30 Mon–Fri, excluding English public holidays). Severity is set by us in good faith.

Severity	Definition	First response target	Update cadence
S1 — Critical	Production platform fully unavailable to all users, or a confirmed data security incident.	Within 1 business hour, with out-of-hours best-effort cover.	Hourly until mitigated.
S2 — High	Major feature unavailable for multiple users; no reasonable workaround.	Within 4 business hours.	Twice daily until mitigated.
S3 — Normal	Functional issue affecting some users with a workaround available.	Within 1 business day.	Daily.
S4 — Low	Cosmetic issue, documentation request, or feature question.	Within 3 business days.	As progress is made.

Contact: hello@trmflex.com with subject prefix [S1], [S2], etc. for triage.

4. Planned maintenance

Routine maintenance is scheduled outside UK business hours where reasonably possible.
Maintenance expected to cause downtime > 5 minutes is announced at least 48 hours in advance via the in-app notification system and the system status page.
Emergency maintenance to address a security or stability risk may be performed without prior notice; we will publish an incident note within 24 hours.

5. Backups and data retention

The production database is backed up daily with a minimum 7-day rolling restore window.
Backups are encrypted at rest.
Customer-controlled retention rules apply to specific data types (see the Privacy Policy).

6. Incident communication

For any S1 or S2 incident we will:

Acknowledge the incident on the in-app status banner and email active customer admins within the response window in section 3.
Provide regular updates at the cadence in section 3.
Publish a written post-incident review within 10 business days of resolution for any S1 incident, including root cause and corrective actions.

7. Security incident notification

Where an incident involves a personal data breach as defined in UK GDPR Art. 4(12), we will notify affected customer controllers without undue delay and in any event within 72 hours of becoming aware, with the information required by UK GDPR Art. 33(3). See the Data Processing Addendum.

8. Service credits

This public SLA is provided in good faith and does not by itself create a contractual right to service credits. Where service credits are agreed in a separate enterprise contract, that contract sets the calculation method and remedies. The remedies set out in any separate enterprise contract are your sole and exclusive remedies for breach of the availability target, save for rights that cannot be excluded by law.

9. Things you do that affect the SLA

The targets above assume that you:

use the platform in accordance with the Acceptable Use Policy;
keep your contact details current so we can reach the right person during an incident;
follow our published rate limits and integration guidance;
apply security patches and updates to systems you control where we instruct you to do so.

10. Changes to this SLA

We may update this public SLA from time to time. Material changes will be communicated to active customer admins by email at least 30 days in advance. Continued use of the platform after the effective date constitutes acceptance.