SLA compliance is the ongoing work of checking whether a vendor is actually delivering the uptime, response times, and recovery speeds its service level agreement promises, and of collecting the remedies the contract provides when it isn’t. An uptime guarantee of 99.9 percent still allows nearly 44 minutes of unplanned downtime every month, and the credits you’re owed for the shortfall almost always require a formal claim filed within 30 to 60 days. Miss that window and the money is gone, no matter how bad the outage was.
The practical job breaks into three parts: measure performance against the right metrics, document failures with records the provider can’t dismiss, and understand what the contract actually lets you recover before you need to find out.
What the SLA Actually Promises
Three numbers do most of the work in a service level agreement: uptime percentage, mean time to recovery, and response latency.
Uptime is a percentage of total available time in a billing period. The tiers sound similar and behave very differently:
- 99.9 percent (“three nines”) allows roughly 43 minutes and 50 seconds of downtime per month, or about 8 hours and 46 minutes per year.
- 99.99 percent (“four nines”) allows about 4 minutes and 23 seconds per month, or roughly 52 minutes per year.
- 99.999 percent (“five nines”) allows approximately 26 seconds per month, or just 5.26 minutes per year.
The math is simple: subtract unplanned downtime minutes from total minutes in the period, divide by total minutes, multiply by 100. The arguments start over what counts as “down.” A service that technically responds but takes 30 seconds to load a page isn’t offline, which is why serious SLAs set latency thresholds in milliseconds alongside the uptime number.
Mean time to recovery measures how long, on average, the provider takes to restore service after a failure. Two vendors can both hit 99.9 percent uptime and deliver very different experiences, one with a single 40-minute outage and the other with dozens of brief interruptions that add up to the same total. If your business tolerates short blips better than long ones, or vice versa, MTTR matters more than the headline uptime figure.
What Doesn’t Count as Downtime
Every SLA carves out categories of downtime that don’t count against the provider’s score. These exclusions are where most compliance disputes live.
Force majeure clauses excuse failures caused by events genuinely outside the provider’s control, covering circumstances like natural disasters, armed conflicts, and government actions.1World Bank. Force Majeure Clauses – Checklist and Sample Wording A hurricane that takes out a data center won’t trigger service credits.
Scheduled maintenance is excluded when the vendor gives advance notice within the timeframe the contract requires. Most providers define a weekly or monthly maintenance window and promise to perform updates only during those hours. Follow the notice rules, and that downtime is free.
Outages caused by your own systems are almost always excluded as well. Local network failures, unauthorized configuration changes by your team, or a third-party internet carrier dropping connectivity will not count against the provider.2Center for Health Care Transformation and Innovation. Service Level Agreement The line between “your problem” and “their problem” during a complex incident is where providers and customers most often disagree.
Monitoring the Provider Yourself
Relying on a vendor’s own reporting to measure compliance is like letting a student grade their own exam. The provider’s incident reports and system logs are useful, but they shouldn’t be your only source.
At a minimum, run independent uptime and latency checks against the provider’s endpoints. Synthetic monitoring tools send automated requests at regular intervals and record response times, error rates, and outage durations with timestamps. When your records disagree with the vendor’s post-incident write-up, independent data gives you something to argue with.
For larger contracts, ask for a current SOC 2 Type II audit report. A Type II report examines whether the provider’s controls operated effectively over a period of three to twelve months, and its availability criteria directly addresses whether the infrastructure actually supports the uptime commitments the SLA makes.3A-LIGN. What Is SOC 2 – Complete Guide A vendor that won’t share one is telling you something.
Filing a Credit Claim Before the Deadline
This is where most organizations leave money on the table. Service credits are rarely automatic. The contract requires a claim filed within a specific window, with supporting documentation, through the exact submission channel it names. Miss the deadline or use the wrong channel and the credit is forfeited regardless of how severe the outage was.
Deadline windows vary across major providers:
- AWS requires credit requests to be received by the end of the second billing cycle after the incident occurred.4Amazon Web Services. Amazon Compute Service Level Agreement
- Google Cloud requires notice to technical support within 60 days of becoming eligible for a credit, with log files showing the downtime periods with dates and times. Failure to comply means forfeiting the credit entirely.5Google Cloud. Compute Engine Service Level Agreement
- Microsoft Azure claims typically must be submitted within 30 to 60 days after the end of the billing month in which the incident occurred.6Microsoft Learn. How to Read a Service-Level Agreement
Most providers want claims through a dedicated support portal, not an email to your account rep. The submission typically needs the exact start and end times of the outage, the affected services or resources, and log data or error messages supporting the claim. Translating your monitoring data into the provider’s required format takes effort, and incomplete submissions get rejected or delayed. Keep a digital receipt or tracking number for every submission in case you later need to prove the claim was filed on time.
What Service Credits Actually Pay
Credits reduce a future invoice; they don’t put cash back in your account. The percentage usually scales with how badly the provider missed. One real provider’s tier structure looks like this:
- Uptime between 99.5% and 99.99%: 5 percent credit
- Uptime between 99.0% and 99.5%: 10 percent credit
- Uptime between 98.0% and 99.0%: 20 percent credit
- Uptime between 97.0% and 98.0%: 30 percent credit
- Uptime below 97.0%: 50 percent credit
Every contract sets its own tiers.7iboss. Service Level Agreement The detail most clients overlook: credits are almost always capped at a percentage of that month’s fees for the affected service, not your total contract value. A 30 percent credit on a $500-per-month service doesn’t go far when the outage cost you $50,000 in lost revenue.
That gap is deliberate. Most SLAs designate service credits as the “sole and exclusive remedy” for performance failures, meaning credits are the only compensation you can collect unless the breach is severe enough to justify terminating the contract.8UNCITRAL. Notes on the Main Issues of Cloud Computing Contracts
The Caps That Limit Your Recovery
Even when a failure goes well beyond what credits cover, two clauses limit what you can actually recover.
The first is the liability cap. In most enterprise cloud agreements, total liability is capped at one times the annual fees paid or payable under the agreement. If you pay $120,000 a year, the maximum you could recover for any failure is $120,000. Some contracts include a higher “super cap” for specific situations like data breaches, but SLA failures sit under the general cap.
The second is the consequential damages waiver. Nearly every commercial SLA bars either party from recovering indirect or consequential damages, which explicitly includes lost profits, business interruption, and loss of data. A three-day outage that costs your company $2 million in lost sales produces no recoverable damages for those losses even if the provider was clearly at fault. The waiver typically applies regardless of whether the claim is framed as contract, negligence, or any other legal theory.
Some contracts carve out exceptions for gross negligence, willful misconduct, or breaches of confidentiality obligations. Negotiating those carve-outs in matters, because without them the provider’s financial exposure for severe failures is small relative to the damage a serious outage can cause.
When Failures Justify Walking Away
Severe or chronic SLA failures can rise to a material breach, which gives you the right to terminate the contract without penalty. Courts generally define a material breach as one so substantial that it defeats the fundamental purpose of the agreement. A total platform failure lasting multiple days with no communication from the provider is a very different animal from a few hours of degraded performance in one region.
Most SLAs include a cure period, giving the provider a set number of days to fix the problem before termination rights kick in. If the contract allows 30 days to cure and the provider resolves the issue inside that window, you’ve lost your termination right for that specific incident. Repeated failures that each get cured individually but collectively show a pattern of unreliability present a harder legal question.
Here is the risk: if you terminate claiming material breach and a court later disagrees, you become the breaching party. That means you owe the provider the remaining contract value and may face your own liability for its losses. The stakes are high enough that most organizations work through escalating remedies, credits, formal dispute resolution, and documented cure demands, before attempting termination.
Using Compliance Data at Renewal
Renewal is the moment when you actually have leverage to improve the terms. If you’ve been tracking compliance throughout the contract, you should have a clear record of how often the provider met or missed targets, how long incidents lasted, and how responsive the claims process was. That record is your negotiating currency.
Start the conversation at least 90 to 120 days before expiration. Waiting until the last minute eliminates your ability to credibly consider alternatives. If the provider consistently missed its uptime target, push for tighter tiers, faster response commitments, or higher credit percentages. If the credits never came close to covering real losses, this is the time to negotiate a higher liability cap or carve-outs from the consequential damages waiver.
Benchmark the terms against competitors before you sit down. If three competing providers offer 99.99 percent uptime with 20 percent credits at the first tier while your current vendor offers 99.9 percent with 5 percent credits, that gap speaks for itself. Providers will usually improve terms rather than lose an established customer, but only if they believe you have a credible alternative ready.