A vendor service level agreement is the contract section that converts a provider’s performance promises into measurable targets and defined financial consequences when those targets are missed. A workable one does five things: it defines the metrics precisely, sets a credit schedule with a claim window, caps the vendor’s liability honestly, lists what doesn’t count as downtime, and gives you a way out when the vendor can’t perform. Weakness in any of those five is where buyers get hurt, and most of the losses show up in the gap between the credit you can collect and the business damage you actually suffered.
The Metrics the Agreement Has to Define
Everything downstream in the contract depends on how performance is measured. If the metric is vague, the credit is unenforceable.
Uptime. Uptime is the percentage of time the service stays accessible during a billing period. Google Cloud defines monthly uptime percentage as total minutes in the month minus downtime minutes, divided by total minutes.1Google Cloud. Compute Engine Service Level Agreement AWS uses a similar subtraction from 100%.2Amazon Web Services. Amazon Compute Service Level Agreement Targets are usually expressed in “nines.” A 99.9% commitment allows roughly 43 minutes of monthly downtime; 99.99% allows about 4 minutes. The engineering cost between those two is not small, which is why credit schedules tighten sharply as the target climbs.
Latency. Latency measures the round-trip time for a request, in milliseconds. Verizon, for instance, averages sample measurements taken over a calendar month between hub routers to decide whether the connection met the threshold.3Verizon. Global Latency and Packet Delivery SLA Latency matters most for real-time workloads: voice, video, trading platforms.
Mean time to repair. MTTR is the average time to restore service after a reported incident. The clock starts when the ticket opens and stops when service is fully functional. Four hours is a common target for top-priority incidents. Contracts generally average all repair times across the billing cycle, so one fast fix will not rescue a month of slow ones.
Error rate. Error rate is the percentage of requests that fail during the measurement period. A commitment of fewer than 0.1% failed requests over a month means 99.9% must succeed. This catches a failure mode uptime misses: a service can be technically “up” while returning errors to a meaningful share of users.
RTO and RPO. Any SLA covering mission-critical services needs both. The recovery time objective sets the maximum window to restore service after a disruption, for example four hours for email or one to two days for financial reporting. The recovery point objective defines the maximum acceptable data loss, measured backward from the moment of disruption; an RPO of one hour means recovery must restore data to within an hour of the incident. Without both numbers in writing, there is no contractual guarantee on how quickly you are back online or how much data you may lose.
Service Credits: Tiers, Deadlines, and Earn-Back
Credits are the standard remedy when the vendor misses a target. They are expressed as a percentage reduction on the next billing cycle, scaled to the severity of the miss.
AWS applies a 10% credit when monthly uptime falls below 99.99% but stays at or above 99.0%, a 30% credit below 99.0% but at or above 95.0%, and a 100% credit when uptime drops below 95.0%.2Amazon Web Services. Amazon Compute Service Level Agreement Google Cloud follows a comparable 10%, 25%, and 100% structure at similar breakpoints.1Google Cloud. Compute Engine Service Level Agreement
Read the ceiling carefully. A “100% credit” applies to the monthly fee for the specific service that failed, not to your entire account. If you run ten services and one goes down, you get credited on that one service’s share of the bill. For a large account, the gap between what you intuitively expect and what the clause actually pays can be substantial.
Credits are not paid automatically. You have to file a formal request inside a defined window, and a missed deadline forfeits the credit no matter how severe the outage was. Spectrum Enterprise requires credit requests within 30 days of the calendar month in which the target was missed.4Spectrum Enterprise. Managed Network Edge Service Level Agreement Industry windows commonly fall between 30 and 60 days after the end of the affected month. Set a recurring internal reminder tied to your monitoring data; this is one of the most frequently missed steps in SLA management.
Some agreements include an earn-back provision that lets the vendor recover previously issued credits by delivering sustained strong performance in later months. The intent is to reward a longer run of good service rather than punish an isolated bad month. If your agreement has one, check two things. First, the measurement window: a year is common. Second, the floor, meaning the performance level so poor that credits become permanent regardless of later recovery. Without a floor, the vendor’s incentive to prevent repeat failures weakens.
Liability Caps and the Credit-vs-Damages Gap
Service credits are the visible penalty. The liability clause often matters more, because it sets the real ceiling on what you can recover when something goes seriously wrong.
Nearly every commercial SLA caps the vendor’s total exposure. The common structure limits liability to one times the annual fees under the agreement. Pay $120,000 a year, suffer a failure that costs your business $2 million, and the vendor’s maximum obligation is $120,000, including any service credits already issued. A higher multiple can be negotiated, but usually at a cost somewhere else in the contract.
Even inside that cap, most SLAs exclude indirect and consequential damages: lost profits, reputational harm, lost opportunities, downstream costs flowing from the outage. UNCITRAL’s guidance on cloud computing contracts specifically warns that fixing service credits as the sole and exclusive remedy can limit a customer’s rights to pursue other relief, including lawsuits or termination.5UNCITRAL. Notes on the Main Issues of Cloud Computing Contracts The practical result: the credit schedule may be the only financial recovery you ever see from the vendor, regardless of what the outage actually cost you.
This is the structural risk every buyer needs to understand before signing. A full credit on a $5,000 monthly service fee does not cover $500,000 in revenue lost during a four-day outage. Business continuity planning, cyber insurance, and vendor redundancy are what close that gap. The SLA almost certainly will not.
What the Agreement Carves Out of Downtime
Not every minute of unavailability counts against the vendor’s performance score. These exclusions are standard, but their drafting determines how easily the vendor can shift bad months into categories that don’t trigger credits.
Scheduled and emergency maintenance. Planned maintenance windows let the provider update hardware or software during designated off-peak hours without affecting uptime. Contracts commonly require five or more business days of advance notice, and the work is usually restricted to overnight or weekend hours. Emergency maintenance follows a shorter notice path and may require only reasonable efforts to notify in advance. Both are excluded from performance calculations. A vendor that routinely invokes emergency maintenance to dodge SLA penalties is gaming the system; track the frequency and push back if the pattern is suspicious.
Force majeure. These clauses excuse performance when extraordinary events beyond the vendor’s control intervene: natural disasters, armed conflicts, widespread grid failures, regional internet outages. The clause is standard and generally reasonable. What to negotiate is the scope. A well-drafted provision lists specific triggering events rather than relying on vague catch-all language, and it requires the vendor to resume performance as fast as possible once the event ends.
Client-caused failures. Downtime caused by your actions typically does not count. If your team misconfigures an integration, exceeds contractual usage limits, or makes unauthorized environment changes, the vendor will not accept responsibility. Fair in principle, but it becomes a dispute magnet when root cause is ambiguous. Strong SLAs define a joint root-cause process rather than letting the vendor unilaterally classify an outage as client-caused.
Security and Data Terms Worth Writing In
Availability metrics do not capture the risk a vendor creates by holding your data. A few clauses close that gap.
Breach notification. Your SLA should specify how fast the vendor must notify you of a security incident. Federal regulations set a baseline. Under the FTC’s Safeguards Rule, covered financial institutions must notify the FTC within 30 days of discovering a breach involving at least 500 consumers’ unencrypted information.6Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know Many SLAs go further and require vendor-to-client notice within 24 to 72 hours of discovery. If no deadline is written in, you may learn of a breach weeks after it happened.
Data residency. If you operate across borders or handle regulated data, pin down where the vendor can store and process it. Residency clauses restrict storage to specified regions; sovereignty provisions acknowledge that data stored in a given country is subject to that country’s laws. A vendor that quietly moves European customer data to a U.S. data center can create a regulatory violation you did not authorize.
Vulnerability patching. Some SLAs commit to remediation timeframes by severity: a 14- to 30-day window for critical vulnerabilities, longer windows for lower-severity issues. There is no single industry standard; what matters is that any commitment exists. Without one, the vendor has no contractual deadline to fix known security holes.
Reporting You Can Actually Verify
A metric you cannot independently check is a metric the vendor controls. Vendors are typically required to deliver monthly reports against every committed metric, and these are the raw data for credit claims. Modern agreements increasingly require real-time dashboards for uptime, latency, and error rate rather than making you wait for an end-of-month summary. Insist on access to the underlying data, not just a vendor-curated snapshot.
Audit rights are the backstop. The strongest agreements include a right-to-audit clause allowing independent testing or third-party monitoring. Professional internal audit standards recommend that every vendor contract include a robust right-to-audit provision and clarity on who pays for the audit.7The Institute of Internal Auditors. Auditing Third-Party Risk Management Some contracts shift the audit cost to the vendor if the audit reveals a material discrepancy between reported and actual performance. Without an audit right, you have no leverage when the vendor’s numbers do not match your experience.
Dispute Escalation
Performance disagreements are inevitable in any long-term agreement, and the SLA should route them through a structured path before they become legal matters. Most contracts use a tiered escalation: operational contacts attempt resolution within a defined window, often five to ten business days; unresolved disputes move to management; from there, to executives with binding authority. Each tier carries its own response deadline. UNCITRAL’s guidance recommends that contracts differentiate between types of breaches and specify remedies at each level, rather than treating all failures the same.5UNCITRAL. Notes on the Main Issues of Cloud Computing Contracts
Termination for Chronic or Catastrophic Failure
Credits address bad months. Termination clauses address a vendor who cannot deliver over time. These are the provisions that let you leave.
A chronic failure clause defines a pattern of repeated misses that counts as material breach. The most common formulation allows termination when the vendor misses the same metric for three consecutive months, or for a specified number of months inside a rolling period such as four out of six. Thresholds vary by metric severity, and the negotiating point is specificity: the definition should be clear enough that you do not need a lawyer to tell you whether it has been triggered.
A single severe event can also trigger an immediate termination right. UNCITRAL’s guidance identifies examples of fundamental breach that may justify termination, including data loss, personal data protection violations, recurrent security incidents, and prolonged service unavailability.5UNCITRAL. Notes on the Main Issues of Cloud Computing Contracts A complete outage lasting more than 24 consecutive hours is a common contractual trigger, though the exact duration depends on how critical the service is.
Most termination rights come with a cure period. The vendor receives written notice and a final chance to fix the problem. Federal government contracting uses a cure notice framework that requires at least ten days for the contractor to address the deficiency before termination for default.8Acquisition.gov. 48 CFR 49.607 – Delinquency Notices Commercial SLAs commonly adopt similar structures with cure periods of ten to thirty days. The clause protects both sides: it gives the vendor a fair shot and it builds the documented record you will need if the vendor fails to cure and you proceed with termination.
Termination is only useful if you can actually leave. A well-drafted SLA requires the outgoing provider to deliver transition assistance for a defined period after termination, typically 60 to 180 days, covering data extraction, knowledge transfer, and parallel operation while you bring a replacement online. Lock in the pricing for transition services when the SLA is signed, not after you have given notice. Otherwise the vendor you just fired becomes the only party capable of extracting your data, with no obligation to help.