Service Level Agreement

1. Scope

This Service Level Agreement ("SLA") describes the service availability commitments, evidence collection schedules, and support response time targets that Circinova (sole trader) ("Circinova", "we", "us") provides to customers subscribed to the Starter and Growth plans.

This SLA does not apply to the Free plan. Customers on the Free plan receive the Service on an "as available" basis with no uptime or support commitments.

This SLA forms part of the Terms of Service at circinova.com/legal/terms and supplements the Main Agreement between Circinova and the Customer. In the event of a conflict between this SLA and the Main Agreement, this SLA shall govern with respect to uptime and support commitments.

2. Definitions

"Uptime" means the percentage of time in a given Measurement Period during which the Service is available and operational for Customer use, calculated as:

Uptime (%) = ((Total minutes in period − Downtime minutes) / Total minutes in period) × 100

"Downtime" means the total number of consecutive minutes during which the Service is completely unavailable or so severely degraded that core features (login, dashboard access, and evidence viewing) cannot be used by the Customer, as confirmed by Circinova's monitoring systems. Downtime is measured from the time Circinova's monitoring infrastructure first records the failure to the time it records the restoration of service.

"Scheduled Maintenance" means planned maintenance activities that are communicated to customers in advance in accordance with Section 5. Time spent in Scheduled Maintenance does not count as Downtime for the purpose of calculating Uptime.

"Measurement Period" means a calendar month (from 00:00:00 UTC on the first day of the month to 23:59:59 UTC on the last day of the month).

"Service" has the meaning given in the Terms of Service: the Circinova cloud-hosted SOC2 compliance automation platform and all associated features and APIs.

"Monthly Fee" means the net subscription fee paid by the Customer for the relevant Measurement Period, excluding VAT and any other applicable taxes. For annual subscribers, the Monthly Fee is calculated as the total annual fee divided by 12.

3. Service Availability Commitment

Circinova commits to the following monthly Uptime targets:

| Plan | Monthly Uptime Target | |------|-----------------------| | Starter | 99.5% | | Growth | 99.9% |

3.1 Illustrative Maximum Downtime

The following table illustrates the maximum Downtime permitted per Measurement Period under each commitment:

| Plan | Monthly Uptime Target | Maximum Downtime per Month | |------|-----------------------|---------------------------| | Starter | 99.5% | ~3 hours 39 minutes | | Growth | 99.9% | ~43 minutes |

4. Exclusions from SLA

The following events and circumstances do not constitute Downtime and are excluded from Uptime calculations:

• Scheduled Maintenance: maintenance activities carried out during the scheduled maintenance window or communicated to customers in advance, as described in Section 5.
• Force majeure events: events beyond Circinova's reasonable control, including acts of God, natural disasters, strikes, epidemics, pandemics, war, terrorism, government action, or failures of the public internet.
• Customer-caused outages: service unavailability caused by the Customer's actions or omissions, including incorrect configuration of integrations, exceeding documented API rate limits, or deliberate or accidental termination of connected services.
• Third-party infrastructure failures: failures of services not controlled by Circinova, such as AWS Global Service Events that affect all customers of the relevant AWS region (us-east-1), failures of GitHub's or AWS's APIs that prevent evidence collection, or failures of the Customer's internet service provider.
• Free plan: the Free plan is excluded from this SLA in its entirety.
• Scheduled maintenance by third parties: planned maintenance by AWS, GitHub, Stripe, or other third-party providers that affects the availability of dependent services, where Circinova has given advance notice or where the provider has given advance notice via their own status communications.
• Beta and preview features: features explicitly marked as "Beta", "Preview", or "Experimental" within the Service are excluded from SLA coverage.

5. Scheduled Maintenance

5.1 Regular Maintenance Window

Circinova's regular scheduled maintenance window is:

Every Sunday, 02:00–04:00 UTC

During this window, Circinova may perform updates, database migrations, infrastructure changes, and other maintenance activities that may cause brief service interruptions. Customers should not rely on uninterrupted access during this window.

5.2 Extended Maintenance

For maintenance activities that require more than 2 hours or that need to be conducted outside the regular window, Circinova will provide at least 48 hours' advance notice to customers via:

• Email to the account holder's registered address

Extended maintenance will be scheduled to minimise disruption and, where possible, will be carried out during off-peak hours for the Customer's primary time zone.

5.3 Emergency Maintenance

In cases where urgent security patching or critical incident response requires immediate action, Circinova may conduct emergency maintenance without advance notice. In such cases, Circinova will notify customers as soon as practicable via email, and incident details will be provided upon request to support@circinova.com.

6. Uptime Measurement

6.1 Monitoring

Circinova's Service availability is monitored continuously using an external uptime monitoring service that checks the availability and response time of the Circinova platform from multiple geographic locations at intervals of no greater than 60 seconds.

6.2 Incident Notifications

Real-time incident updates are published via email to affected customers. Customers can contact support@circinova.com to subscribe to incident notifications.

6.3 Authoritative Measurement

Circinova's internal monitoring logs and the external uptime monitoring service's records are the authoritative source for Uptime calculations for the purpose of SLA credit claims. Where there is a discrepancy between customer-reported downtime and Circinova's monitoring records, Circinova's records will be used, subject to the Customer providing evidence (such as server logs or screenshots) that suggests a monitoring gap.

7. SLA Credits

7.1 Credit Schedule

If the Service fails to meet the applicable monthly Uptime target, the Customer may request an SLA credit as follows:

| Monthly Uptime Achieved | Credit (% of Monthly Fee) | |------------------------|--------------------------| | Below target but at or above 99.0% (Starter) or 99.5% (Growth) | 10% | | 95.0% – below 99.0% | 25% | | Below 95.0% | 50% |

For example, if a Starter customer's Monthly Fee is $499 and Uptime for the month was 98.5%, the Customer is entitled to a credit of 25% × $499 = $124.75.

7.2 Application of Credits

SLA credits will be applied as account credit against future invoices. Credits are not paid as cash or bank transfers. If a Customer's account is terminated before a credit can be applied, any outstanding credits will be forfeited unless Circinova, at its sole discretion, agrees to make a cash payment.

7.3 Credit Request Deadline

To claim an SLA credit, the Customer must submit a request within 30 calendar days of the end of the Measurement Period in which the Uptime failure occurred. Requests submitted after this deadline will not be considered. See Section 10 for how to submit a claim.

7.4 Maximum Credit

The maximum total SLA credit for any single Measurement Period shall not exceed 50% of the Customer's Monthly Fee for that period, regardless of the number or duration of incidents.

7.5 Non-Stackable Credits

SLA credits are not stackable. Where a single Downtime event spans multiple Measurement Periods, credits will be calculated and applied separately for each Measurement Period based on the Uptime achieved in each respective period.

8. Evidence Collection SLA

The Service's compliance evidence collection function (the automated retrieval of data from connected integrations) operates to the following schedules. This is a separate commitment from overall Service uptime.

| Plan | Evidence Collection Frequency | Permitted Variance | |------|------------------------------|-------------------| | Starter | Every 6 hours | ±30 minutes | | Growth | Every 1 hour | ±15 minutes |

Collection may be delayed beyond the permitted variance due to: Scheduled Maintenance, third-party API rate limiting or outages (including GitHub and AWS API issues), or force majeure events. Such delays do not entitle the Customer to SLA credits unless they also result in an Uptime failure that meets the thresholds in Section 7.

Customers can view the timestamp of the most recent successful evidence collection run for each integration on their dashboard.

9. Support Response Times

Circinova's support team is available Monday to Friday, 09:00–18:00 UTC (excluding UK public holidays). "Business hours" and "business days" in this SLA refer to this schedule. Support is accessed via email at support@circinova.com.

The following response time targets apply to support tickets submitted by customers on paid plans:

| Priority Level | Description | Starter Target Response | Growth Target Response | |---------------|-------------|------------------------|----------------------| | Critical | The Service is completely unavailable or a core feature is non-functional for all users in the organisation | 4 business hours | 1 business hour | | High | A significant feature or integration is unavailable or producing materially incorrect results; no viable workaround exists | 1 business day | 4 business hours | | Normal | Questions, requests for configuration assistance, non-urgent bugs, and feature enquiries | 3 business days | 1 business day |

9.1 Priority Classification

Priority is initially assessed by the Customer at the time of submitting the support request. Circinova reserves the right to reclassify the priority level if the issue as described does not match the stated priority level.

9.2 "Response" Definition

"Response" means an initial reply from a Circinova support team member acknowledging the issue and providing an initial assessment or next step. It does not mean full resolution of the issue within the stated timeframe.

9.3 Out-of-Hours Incidents

For Critical priority incidents that arise outside of business hours, customers should email support@circinova.com with "CRITICAL:" at the start of the subject line. Circinova will use commercially reasonable efforts to respond to Critical out-of-hours incidents, but the SLA response time targets are measured in business hours and do not guarantee 24/7 on-call coverage.

10. How to Claim SLA Credits

To submit a claim for an SLA credit, please email support@circinova.com within 30 days of the end of the relevant Measurement Period with the following information:

• Your account email address and company name
• The Measurement Period for which you are claiming a credit (e.g. "May 2026")
• The date(s) and time(s) of the incident(s) you are claiming for
• A description of the impact experienced
• Any supporting evidence (e.g. error messages, screenshots, or logs)

Circinova will review your claim against our monitoring logs and respond within 10 business days with a decision. If your claim is approved, the credit will be applied to your next invoice. If your claim is denied, we will explain the reason, including the relevant monitoring data.

11. Limitation of Liability

SLA credits as described in Section 7 are the Customer's sole and exclusive remedy for any failure by Circinova to meet the Service availability commitments in this SLA. Failure to meet an uptime target does not entitle the Customer to terminate the Main Agreement without penalty, to withhold payment of fees, or to claim damages beyond the applicable SLA credit.

This clause does not limit any liability that cannot be excluded under applicable law.

12. Changes to This SLA

Circinova may update this SLA from time to time. Circinova will provide at least 30 days' written notice before any reduction in service availability commitments takes effect. Notice will be provided by email to the account holder's registered address. Changes that improve commitments (such as higher uptime targets) may take effect immediately.

If you do not agree to a change that reduces your SLA commitments, you may terminate your subscription before the change takes effect and receive a pro-rated refund of any unused prepaid fees in accordance with the Refund Policy at circinova.com/legal/refunds.

13. Contact

For SLA credit claims and service availability enquiries:

Circinova (sole trader) — Support Email: support@circinova.com United Kingdom