SLA (Service Level Agreement)

What is an SLA?

SLA (service level agreement; German: Leistungsgütevereinbarung) refers to the contractual determination of what quality a service provider promises for an ongoing service, how this quality is measured and what consequences a shortfall has. Typical subjects are the availability of an online service, response and recovery times in the event of faults, and the service hours of customer support. The principle resembles a parcel service that promises delivery on the next working day and refunds part of the fee in case of delay.

SLAs are found above all in contracts for software as a service, data centre and cloud services, IT operations and outsourcing, usually as an annex to the main contract. Software as a service (SaaS) refers to software that is used over the internet instead of being installed at the customer's premises. For a software provider they work in two directions: towards customers as its own promise, towards data centres and upstream suppliers as purchased protection. In financing rounds and company sales they are a subject of the legal and technical due diligence, that is, the review by investors and buyers before the transaction. There, SLAs show liability risks and the operational maturity of a company.

The usual metrics

• Availability: the share of the agreed operating time in which the service is usable, usually measured per calendar month and stated as a percentage.
• Response time: the time between a fault report and the start of handling by qualified staff, graded by the severity of the fault.
• Recovery time: the time until the fault is eliminated or a viable workaround is in place. It is more meaningful for customers than the response time but is less often promised bindingly.

As important as the target values are the measurement rules: where measurement takes place, for example at the data centre's connection to the internet, who measures and how outages are documented. Announced maintenance windows and faults caused by the customer are usually excluded from the calculation.

Availability in percent and minutes

A month of 30 days has 43,200 minutes. This yields the following permissible downtime per month:

• 99%: 1% of 43,200 minutes = 432 minutes, that is 7.2 hours
• 99.5%: 0.5% of 43,200 minutes = 216 minutes, that is 3.6 hours
• 99.9%: 0.1% of 43,200 minutes = 43.2 minutes
• 99.99%: 0.01% of 43,200 minutes = around 4.3 minutes

A month of 31 days has 44,640 minutes; at 99.9%, around 44.6 minutes of downtime are then permissible. The step from 99.9% to 99.99% generally requires a different technical set-up. This includes mirrored systems at several locations, automatic failover and round-the-clock standby. If measurement is annual rather than monthly, outages may be spread over the year: at 99.9% that is 525,600 minutes × 0.1% = around 8.8 hours, which can also occur on a single day.

Service credits and limitation of liability

The usual consequence of a shortfall is a service credit, that is, a deduction from the next invoice, graded according to the extent of the shortfall. In practice the tiers often start at around 5 to 10% of the monthly fee. In the case of substantial shortfalls they rise to a quarter up to a half, limited by a cap per month.

The legal classification depends on the contract. The prevailing view in Germany assigns contracts for the provision of software over the internet to rental law, at least as far as the making available of the software is concerned. Support and consulting services, by contrast, often follow the law of service contracts. Rental law provides for a reduction of the fee by operation of law in the event of defects (Section 536 of the German Civil Code, BGB). Depending on their design, credits can be classified as a lump-sum reduction, as lump-sum damages or as a contractual penalty; there is no uniform line. The SLA should therefore expressly regulate how credits and the statutory reduction relate to each other and whether credits are credited against damages.

Providers often want to make the credit the sole legal consequence. Standardised SaaS contracts, however, are as a rule general terms and conditions, whose clauses are measured against Sections 307 et seq. BGB. An exclusion of liability is then generally invalid to the extent that it covers intent and gross negligence, injury to life, body and health or the breach of material contractual obligations. Liability caps are also common, for example in the amount of the annual fee. In the case of slightly negligent breach of material obligations, they hold in general terms and conditions only if they cover the damage foreseeable as typical for the contract.

Significance in due diligence and company purchase

Buyers examine the SLAs of the material customer contracts, the values actually achieved over the past 12 to 24 months and the credits granted. Decisive is the comparison with the contracts of the upstream suppliers. Known findings such as unlimited credits or missing liability caps are usually taken into account in the purchase agreement through an indemnity or a price adjustment. Through a warranty, the buyer secures that no further commitments of this kind exist.

When part of a business is sold, the seller often still provides IT and administrative services to the buyer for a transitional period. The quality of these is likewise set through service levels in an agreement on transitional services (transition services agreement).

Worked example

A software provider promises monthly availability of 99.9%. The credits are 10% of the monthly fee below 99.9%, 25% below 99.5% and 50% below 99.0%, at most 50% per month. The month has 43,200 minutes, and a customer pays EUR 10,000 a month.

• Measured faults: 150 minutes, of which 30 minutes in an announced maintenance window
• Relevant downtime: 150 minus 30 = 120 minutes
• Availability: (43,200 minus 120) divided by 43,200 = 43,080 divided by 43,200 = 99.72%
• Classification: below 99.9% but above 99.5%, so a 10% credit: 10,000 × 0.10 = EUR 1,000
• Variant with 500 minutes of downtime: (43,200 minus 500) divided by 43,200 = 98.84%, so a 50% credit: EUR 5,000

If the outage of 500 minutes affects all 80 customers with an average monthly fee of EUR 10,000, the credits add up to 80 × 5,000 = EUR 400,000. If the provider's own data centre contract grants at most 10% of a monthly fee of EUR 40,000 for the same fault, the provider receives EUR 4,000. The gap of EUR 396,000 shows why buyers lay their own commitments and purchased protection side by side. A single serious outage costs the provider here half of its monthly revenue of 80 × 10,000 = EUR 800,000.

Distinction from related terms

• API (programming interface): the technical access through which another system retrieves data and functions. Whether this access is reliably reachable and how quickly faults are remedied is regulated only by the SLA.
• Service description: determines what is owed. The SLA determines in what quality and with what reliability this service is provided.
• Liability cap: limits the total liability under the contract. Depending on the contract, credits are credited against it or owed in addition.

Common mistakes

• Promise without measurement rule. If it is not specified who measures where, the promise can be neither enforced nor defended.
• Credits without a cap. If credits are calculated per incident rather than per month and are not limited, they can exceed a customer's fee.
• Maintenance windows not regulated. Without the exception, every planned update counts as downtime.
• Promised more than is covered. A provider that promises customers 99.99% while its data centre assures 99.9% bears the risk of the difference alone.
• Overestimated exclusion of liability. A clause under which credits exclude any further liability holds in general terms and conditions only within narrow limits.

Frequently asked questions

When does a software company need an SLA?

As soon as customers use the product in business-critical processes. Larger enterprise customers regularly demand one in the procurement process.

What does availability of 99.9% mean in concrete terms?

Around 43 minutes of permissible downtime in a month of 30 days, with annual measurement around 8.8 hours a year. Planned maintenance windows count only if the contract does not exclude them.

Can an availability of 100% be promised?

No, and it would not be responsible. Every system has faults and maintenance needs; with a promise of 100%, every interruption would be a breach of contract.

Can customers claim damages in addition to the credit?

That depends on the contract and on fault. Unless liability is effectively limited, claims for damages remain in principle possible where there is fault. It is often agreed that credits are credited against them.

How do SLAs affect company valuation?

Indirectly, through risk and customer retention. Commitments that are met, with seamless measurement, demonstrate operational maturity and ease access to enterprise customers. Commitments without backing from upstream suppliers or without a limitation of liability increase the risk that a buyer takes into account in the price or in the drafting of the contract.

The Roemer Capital view

Before a sale process begins, we lay the SLAs of the largest customer contracts next to the contracts of the data centre and the other upstream suppliers. Where the company's own commitment is higher than the purchased protection, we quantify the difference before a buyer raises it as a liability risk. The adaptation of the clauses is handled by the client's law firm.

In addition, we compile the availability levels achieved and the credits granted over the past two years. A seamless series of measurements in the data room, in which investors and buyers inspect the documents, demonstrates operational maturity and supports the assumptions on customer retention in the financial model.