1. Scope and Application
This Service Level Agreement (SLA) sets out the service coverage, response targets, and security practices applicable to Services identified in an Order.
Services are performed with reasonable care and commercially reasonable efforts. Response and recovery targets are not guarantees of uninterrupted service, successful recovery, or a particular result.
This SLA is subject to the Master Services Agreement (MSA), including its liability limits. “Order” has the meaning defined in the MSA. The Data Processing Addendum (DPA) applies to processing of personal information on Client’s behalf.
2. Service Categories
Hosting, maintenance, and ongoing improvement services are separate and may be combined in an Order. Pantheon Hosting and Standard Hosting do not, by themselves, include a Maintenance Plan or WebOps Retainer.
Website projects
A project covers the website, redesign, migration, or integration described in your Order. It includes the relevant development practices below and the project warranty in Section 11. Ongoing hosting and maintenance are selected separately.
Hosting Only
Includes hosting setup and administration, infrastructure support, provider coordination, automated backups, and urgent protective action. Website software updates, plugin troubleshooting, content changes, and ongoing application security checks are separate.
Maintenance Plan
Includes monthly software updates and security checks, technical support for the supported website, and initial help with security incidents. New features, redesigns, content work, and substantial recovery or replacement work require a separate approved scope. Hosting is separate.
WebOps Retainer
Includes Maintenance Plan services, priority response targets, and allocated time for website improvements. Accessibility and privacy reviews are planned within the purchased scope and hours. Hosting is separate.
Your Order sets the retainer scope and hours. Unused hours roll over monthly and are non-refundable, subject to the MSA’s refund provisions.
On-Demand Services
Individual requests outside a project or managed plan are scoped and billed separately, as described in Section 12.
3. Support & Response Times
An initial response means we acknowledge the request, assess its priority, and confirm the next steps. These targets apply to the services included in your plan. They measure our initial response, rather than the time needed to resolve the issue.
| Priority | Examples | Hosting Only | Maintenance Plan | WebOps Retainer |
|---|---|---|---|---|
| P1 Critical | Site down, suspected compromise, personal data exposed | 4 hours (infrastructure only) | 4 hours | 2 hours |
| P2 High | Key feature or form broken, no workaround | N/A | 1 business day | 4 hours |
| P3 Normal | Bug with a workaround, minor display issue | N/A | 2 business days | 1 business day |
| P4 Request | Changes, content help, questions | Scheduled, billed hourly | 5 business days | 3 business days |
How the targets work
Our support hours are Monday to Friday, 8:00 a.m. to 4:00 p.m. Pacific, excluding statutory holidays in British Columbia. The response clock runs only during those hours. One business day represents eight support hours. For example, a four-hour target for a request received at 3:00 p.m. on Friday falls at 11:00 a.m. on Monday, provided Monday is a business day.
Send requests through the support channel supplied at onboarding. For a critical incident, use the designated urgent contact method. Both use the support hours above; an urgent contact method does not provide a staffed after-hours service. We provide these contact details before service begins.
We assign priority based on the impact and information available and may revise it as we investigate. Include the affected page, what happened, and when it started. Share credentials through our designated secure method, rather than in a support ticket.
What technical support covers
Maintenance Plans and WebOps Retainers include investigation and routine repair of supported features that stop working as delivered. This covers supported forms, integrations, templates, plugins, and themes. We assess security issues and use practical temporary safeguards when a patch is unavailable.
New functionality, design changes, content, training, substantial rebuilding, and replacement of discontinued products require an approved scope and budget. Client changes, independent provider failures, and incidents requiring substantial cleanup may also require additional approved work. We explain this before carrying out billable work.
Covered project warranty requests use the Maintenance Plan response targets. New work is scheduled separately from the initial response.
4. Hosting & Availability
We offer two hosting options. Both include our setup and administration, coordination with the infrastructure provider, the backup services in Section 7, and proportionate action to protect affected services. We keep you informed of significant interruptions.
Pantheon Hosting
Managed WordPress hosting on Pantheon’s cloud platform, with:
- Separate development, testing, and live environments, with version-controlled code releases.
- Managed HTTPS and content delivery through Pantheon’s CDN.
- Automated website backups, as described in Section 7.
- Provider support available under the selected plan.
We test code changes before release. Your Order identifies the plan and hosting region. Additional firewall, monitoring, and performance features depend on the services enabled for your site.
Standard Hosting
Shared website hosting on a dedicated server managed by Twirling Umbrellas and operated by Canadian Web Hosting in Vancouver, with:
- Hosting configuration and server administration within our scope.
- HTTPS configuration.
- Automated website backups, with the frequency, retention, and included data recorded in your Order before service begins.
- Infrastructure support coordinated by us with Canadian Web Hosting.
Your Order identifies the allocated resources and any additional CDN or firewall services.
Availability & provider support
Pantheon Performance plans publish a 99.9% monthly availability objective. Canadian Web Hosting publishes a 99.9% monthly infrastructure availability guarantee, subject to its terms. These are provider measures; they do not guarantee that every website feature will remain available.
We coordinate provider escalation for infrastructure issues. Provider support hours and access depend on the selected plan. Pantheon emergency support may require an authorised provider account. Our website support follows the hours in Section 3.
Any provider service credit is subject to the provider’s eligibility and claim rules. We pass on credits actually issued to us for your affected hosting service. This SLA does not create an additional agency uptime guarantee or automatic service credit.
Urgent protective action
If a website, account, or service presents an immediate security threat, we may take proportionate temporary action without waiting for advance approval. This can include disabling a compromised account, blocking harmful traffic, taking an affected feature offline, or temporarily restricting the website.
We limit restrictions to what is reasonably necessary, notify your designated contact promptly, and restore access as soon as reasonably practicable once the risk is addressed. Additional billable recovery work follows Section 6.
5. Security Practices & Maintenance
Our safeguards reflect the services, systems, and information involved. They reduce risk but cannot prevent every incident. Processing of personal information follows the DPA.
Access & credentials
We use individual accounts, limit access to what is needed, and store credentials in an encrypted password manager. We require multi-factor authentication for our hosting and service administration accounts and for client WordPress administrative and editing accounts. Where a platform cannot support it, we assess the access risk and document suitable safeguards.
We remove our staff’s access promptly when their roles change. We update client access when notified of staff changes and review client accounts on request.
Current insurance certificates are available on request.
Development & hosting
We follow WordPress coding standards and relevant OWASP guidance, including input validation, output escaping, and permission checks. We use maintained components and protect public forms against automated abuse.
We configure HTTPS and apply security headers, logging, and platform protections appropriate to the website and its integrations. Firewall, bot protection, and other provider safeguards depend on the hosting platform and enabled services. We avoid recording credentials and unnecessary personal information in logs.
Maintenance Plans & WebOps Retainers
- Software updates: We apply and test WordPress, theme, and plugin updates monthly. Testing reflects the change and the website’s supported functionality.
- Critical patches: We aim to assess a critical patch within one business day of release, taking account of severity and exposure. Assessment determines the next action; it is not a promise to deploy every patch within one day.
- Security checks: We run malware scans and review security logs monthly.
- Unsupported software: We identify unsupported components and recommend appropriate replacements. Substantial replacement work requires approval.
Hosting Only does not include ongoing application updates or these monthly security checks. Our standard plans do not include continuous human monitoring, a staffed after-hours security service, penetration testing, forensic investigation, or compliance certification.
6. Security Incidents
We assess reported incidents using the applicable P1 response target and explain the information available, the action taken, and the next steps. Initial findings may change as we investigate.
Hosting Only includes infrastructure provider coordination and urgent protective action. Maintenance Plans and WebOps Retainers also include initial investigation, practical containment, and restoration assistance within their scope. Specialist investigation, substantial cleanup, rebuilding, and work outside the supported website require a separate approved scope.
Additional work, including substantial recovery from an independent software vulnerability, requires approval of the scope and costs or spending limit. Warranty remedies and responsibility for our work follow the MSA.
Where personal information is affected, incident notification and cooperation follow the DPA.
Report suspected incidents promptly through the designated urgent contact method, provide someone authorised to make decisions, and preserve relevant accounts and files. Avoid changes that could hinder assessment, except where action is needed to contain an immediate threat.
7. Backups & Recovery
We use reasonable care and commercially reasonable efforts to configure and administer automated backups for the websites we host. We check that scheduled backups are running and take an additional backup before major updates or deployments.
Backup coverage
- Pantheon Hosting: Nightly backups retained for seven days, plus a weekly backup retained for one month. These include committed website code, the database, and files in the standard uploads directory. Uncommitted code and externally stored data are excluded.
- Standard Hosting: The frequency, retention, included data, and storage arrangements are recorded in your Order before service begins.
Longer retention, independent backup copies, and backups of external systems require additional scope. The recovery limits below apply to those services too.
Restoration
We use commercially reasonable efforts to restore from the most recent suitable clean backup. Our recovery target is one business day after the decision to restore. Backup condition, site size, access, the incident, and provider availability can affect the outcome and timing.
Maintenance Plans and WebOps Retainers include restoration assistance within their scope. Separately billable Hosting Only restoration work requires cost approval.
Recovery limits & client records
Backups may be incomplete, corrupted, outdated, or unavailable. We do not guarantee successful or complete recovery, a particular restoration time, or a maximum amount of data loss. Website backups are not a records archive. Keep independent copies of important business records, submissions, member data, source documents, and other information you need to retain.
Backup and recovery services remain subject to the MSA’s exclusions and liability limits.
8. Accessibility
Our standard for website templates and components we build is WCAG 2.1 Level AA or the accessibility standard specified in your Order. We use accessible navigation, headings, forms, and interactions, check the work through automated and manual testing, and provide editor guidance. Any additional accessibility work is identified in your Order.
Whole-site accessibility also depends on content, documents, media, and third-party tools. You are responsible for maintaining accessible content and providing a way for visitors to report barriers.
We correct accessibility problems caused by our maintenance updates. WebOps accessibility checks and improvements are planned within the retainer scope and hours. PDF remediation, accessible media production, independent audits, VPATs, and certification are separate services.
9. Privacy & Data Handling
You decide what personal information to collect, why it is needed, and the notices, consents, and retention requirements that apply. We implement the technical privacy features included in your Order and follow the DPA when processing personal information on your behalf.
This can include approved form fields and destinations, access restrictions, available retention settings, and consent controls for analytics and tracking. We use HTTPS and avoid unnecessary personal information in logs. WebOps privacy reviews and related changes are planned within the retainer scope and hours.
Your Order records the hosting region and any required location restrictions. Canadian hosting does not mean every connected service processes data in Canada. Tell us about sensitive information and residency requirements before providing data or enabling collection. Standard website forms are not intended for sensitive information; suitable collection and safeguards must be assessed first.
Data access, return, deletion, and retained backup copies follow the MSA and DPA. Legal advice, policy drafting, records management, and guarantees about independent providers’ data locations are outside our standard service scope.
10. Client Responsibilities
Provide current primary and backup contacts, someone authorised to approve urgent decisions and costs, and timely access, information, and approvals. Keep domain, DNS, hosting, and other service accounts current.
Use individual accounts with MFA, tell us when access should be removed, and consult us before adding code, plugins, tracking, or integrations. Report problems through the designated channel. Keep independent records, maintain accessible content and privacy notices, and tell us about sensitive data or special retention requirements.
11. Warranty
Website projects include the 90-day software warranty in MSA Section 3.15, starting from the agreed-upon launch date or, if none, final delivery. It covers reproducible defects within the original scope, with the exclusions and remedies in that section. Completion follows MSA Section 3.14.
Keep the website properly maintained from launch. Covered warranty requests use the Maintenance Plan response targets.
12. On-Demand Services
Work outside a project or managed plan requires written approval from an authorised contact. We confirm the task and billing basis before work starts where these have not already been provided. Diagnostic work can be authorised first, with the rate and spending limit confirmed before it begins.
Scheduling depends on urgency, risk, team availability, and existing commitments. A separately approved task does not acquire a managed plan’s response targets merely because we accept it. Scope changes, rush work, and after-hours charges follow the MSA’s approval requirements.
On-Demand work does not include ongoing maintenance, managed-plan response targets, or the project warranty. Additional services require an approved scope and price.
13. Review & Related Agreements
We update this SLA as our services and platforms change. Your Order identifies the applicable versions; publishing an update does not change an accepted Order. Changes follow MSA Section 16.1.
Related agreements: Master Services Agreement and Data Processing Addendum.
