Service Level Program for Ariba cloud Services. Service Accessibility Warranty Security Miscellaneous

Transcription

1 Service Level Program for Ariba cloud Services Service Accessibility Warranty Security Miscellaneous 1. Service Accessibility Warranty a. Applicability. The Service Accessibility Warranty applies to the applicable Solution. "Solution" or Service means and includes the following products if transacted for and paid for by Customer (or "You"), as identified on a contract between You and Ariba or another SAP company, and for the applicable data center Customer uses to access the Services listed here: SAP means the SAP company with which You contracted for the Service. b. Warranty. i. Percentage. The Service will be accessible 99.5% percent of the time, seven days a week, twenty-four hours per day, as calculated over a calendar month (the "Service Accessibility Warranty"). The Service Accessibility Warranty of 99.5% corresponds to 522,972 (= * 60 * 24 * 365) minutes of uptime per year. ii. Remedy for Non-Compliance. If the Service fails to meet the Service Accessibility Warranty, SAP will issue to Customer's account the number of Total Credit Units resulting from application of the formula below. Customer may use the Credit Units towards any future purchases of Services from SAP. (A) Calculation. The number of Total Credit Units is calculated as follows: Total Credit Units = [Inaccessibility Period (in minutes rounded up) ] X the Per Minute Pro-rated Annual Subscription Fees actually paid (for the individual applicable Solution). "Inaccessibility Period" means the period of time that the Service failed to meet the Service Accessibility Warranty. Only an inaccessibility occurring in the data center used by Customer for its subscribed product(s) will count against the Inaccessibility Period measurement. "Credit Unit". A Credit Unit is a representation of a unit of currency, in the same currency as Customer paid SAP for the applicable Solution, such as Euros, U.S. Dollars or otherwise. One Credit Unit is equal to one unit of currency. For example, if Customer paid in U.S. Dollars, one Credit Unit would equal $1.00

2 USD. "Annualized Period" means a twelve month period commencing on the anniversary date of Customer's subscription to the applicable Solution. For example, if Customer transacts for a two year subscription to a Service starting on January 1, 2015, then the two Annualized Periods are (a) January 1, 2015, until December 31, 2015; and, (b) January 1, 2016, until December 31, "Per Minute Pro-rated Annual Subscription Fee" means the amount which Customer actually paid to SAP for the applicable Service that corresponded to the applicable Annualized Period divided by 525,600 (=60*24*365) minutes in a year. Note: If Customer licensed certain Ariba software products prior to December 2006 and is obtaining use of the Ariba Network as a Foundation Services as part of Technical Support Services Fees, then Technical Support Services Fees are used for purposes of calculating the Annual Subscription Fee. c. Scheduled Downtime. When needed, SAP will schedule downtime for routine maintenance or systems upgrades ("Scheduled Downtime") for the Solution. SAP shall exercise commercially reasonable efforts to schedule maintenance and system upgrades outside of peak traffic periods. Generally, such maintenance or system upgrades are scheduled to occur from Saturday, 8:00AM to Saturday, 8:00PM Pacific Time ("Maintenance Window"). SAP reserves the right to extend or change the times of the Maintenance Window. SAP will use commercially reasonable efforts to notify Customers at least 72 hours prior to the occurrence of Scheduled Downtime. d. Exclusions. In calculating the Inaccessibility Period, the following will not apply: (i) Scheduled Downtime for which Customer has been notified at least one business day prior to such Scheduled Downtime; (ii) inaccessibility that is not the fault of SAP (such as failures caused by factors not under SAP s direct control, for example where caused by equipment or software under the control of a third party), and (iii) inaccessibility due to Customer request or where Customer approved in advance. Customer shall be solely responsible for maintaining adequate controls over Customer's Data transmissions to the Service, for monitoring such transmissions, and for bringing to SAP's attention any failure to access the Service within (5) days of inception of any such event. Customer shall be solely responsible for setting applicable data processing and transmission parameters, for inspecting all data input and output for accuracy and completeness. 2. Security Elements. The Service contains the following security elements: a. Physical Security. The Service is either under SAP s control or is located at a secure, third party off-site facility. Access to the hardware, software, and other

3 elements comprising the Service is limited to authorized personnel only. SAP uses servers with redundant features for maximum accessibility. b. Disaster Recovery. The Service utilizes a disaster recovery plan to allow for SAP to meet the Service Accessibility Warranty stated in this Service Level Program. c. Data Security. Transactions made using the Service are initially stored in a database to prevent loss. All Customer Data resident on the systems is backed up daily. Backups are stored off-site at a secure third party location. Backups include Customer's registration and account information. The Service receives periodic preventive maintenance. This preventive maintenance is scheduled for times outside of peak traffic periods. As applicable, transaction queues wait while maintenance occurs, and they resume processing when maintenance concludes. Only the organizations involved in a Transaction are permitted to see that Transaction, except to the extent SAP is asked to debug a technical issue and needs to access a Transaction document. As applicable [1], the Service runs redundant copies of all of the critical software subsystems related to Transaction routing. This redundancy enables fail-over in the event of an error so that disruption of the Service is minimized. d. Service Security. SAP implements commercially available security software, hardware and techniques to minimize and prevent non-authorized use of the Solution. These include firewalls, intrusion detection software tools, and monitored use of the Solution. The Service also performs authentication of interactive user sessions. For increased security, the Service uses HTTPS, which is HTTP over SSL (Secure Sockets Layer). The SSL security protocol provides data encryption, server authentication, message integrity, and optional client authentication for TCP/IP connections. The Solution's Webservers use a server digital certificate to enable SSL connections. e. Verification by Auditor. As to SAP s data centers hosting the Services in existence as of the date of this document, the commitments to the Service are audited at least once per year by a recognized third party auditor, to verify SAP s performance with these commitments to Security. Please see the WebTrust seal awarded to SAP s unit Ariba. As to any future net new data center to host the Services, SAP will include such data center within scope for the next scheduled audit.

4 3. Miscellaneous a. Service Integrity. Customer agrees not to: (i) use any device, software or technique to interfere with or attempt to interfere with the proper working of the Solution; (ii) post or send to the Service anything that contains a virus, bug, cancelbot, worm, Trojan Horse or other harmful item; (iii) take any action which imposes an unreasonable or disproportionately large load on the Service such that other users are adversely affected; or (iv) use any device or technology to provide repeated automated attempts to access password-protected portions of the Service for which Customer does not have a valid password issued to Customer by Ariba or SAP. Customer may not allow any third parties to use Customer's password without SAP s prior written consent. Customer also understands that SAP cannot and does not guarantee or warrant that files or non-sap software of any kind, or from any source, available for downloading through the Solution, will be free of infection or viruses, worms, Trojan Horses or other code or defects that manifest contaminating or destructive properties. Customer acknowledges that SAP has the right, but no obligation, to take such actions related to use of the Service (including but not limited to removing content or denying routing of certain data) if SAP reasonably believes that such actions are needed to comply with the law. b. For the convenience of our global customers, this document may be translated into several languages. Please bear in mind that in the event of any ambiguity created by such translations, the substance in the English version will control. c. EXCEPT FOR THE EXPRESS SERVICE ACCESSIBILITY WARRANTY STATED IN THIS SECTION 1, THIS DOCUMENT DOES NOT (I) CREATE ANY OTHER REPRESENTATION OR WARRANTY RELATED TO THE AVAILABILITY, ACCESSIBILITY, OR USABILITY OF THE SOLUTION; or (II) DIMINISH, ALTER OR NEGATE ANY OTHER EXPRESS WARRANTY(IES) IN ANY SIGNED AGREEMENT BETWEEN THE PARTIES. The remedies stated in Section 1 are Customer's sole and exclusive remedies, and SAP s sole liability, for failure to meet the warranties stated in section 1 above. [1] If you use an OnPremise product of Ariba and buy Hosting Services for Ariba or SAP to host a distinct implementation dedicated to you, then this sentence does not apply if Ariba/SAP

5 performs that hosting through SAP s subcontractor AT&T. Instead, the AT&T hosting does not run redundant copies of all of the critical software subsystems, but the Service will still perform within the Service Accessibility Warranty percentage. Note that for most customers receiving such Hosting Services, AT&T is not utilized. SLP 1 March 2014