Service Level Agreement
This Service Level Agreement (“SLA”) sets out the specific maintenance and support services that ChromaDiverse, Inc. (“ChromaDiverse,” “we,” “our” or “us”) will provide in connection with the ChromaDiverse Digital Vault (the “CD Digital Vault”) that you, the Client (“Client,” “you” or “your”) have purchased under one or more Service Orders, which Service Orders and this SLA are subject to the terms and conditions of the Master Services Agreement (the “MSA”) entered into between you and us. Capitalized terms not otherwise defined in this SLA shall have the meaning given such terms in the MSA. This SLA may be modified or updated at any time and at the sole discretion of ChromaDiverse. ChromaDiverse will provide products and services under this SLA only to clients who are in compliance with the terms of the MSA and each Service Order.
Acceptable Use Policy
Here at ChromaDiverse, our goal is to help you and your team do the best work of your lives, every day. To do this, we need to keep our products and services running smoothly, quickly, and without distraction. For this to happen, we need help from you, our users. We need you not to misuse or abuse our products and services.
To describe exactly what we mean by “misuse” or “abuse”—and to help us identify such transgressions, and react accordingly—we’ve created this Acceptable Use Policy. Under this policy, we reserve the right, in our sole discretion, to remove any content that is inconsistent with the spirit of the guidelines, even if it’s something that is not expressly forbidden by this policy. In other words, if you do something that isn’t listed here verbatim, but it looks or smells like something listed here, we may still remove it.
You’ll see the words “products” and “services” a lot throughout this SLA. Those terms refer interchangeably to the CD Digital Vault and all tools and services provided by or at the direction of ChromaDiverse.
Here’s what we won’t allow:
Disruption:
- Compromising the integrity of our systems. This could include probing, scanning, or testing the vulnerability of any system or network that hosts our services.
- Tampering with, reverse-engineering, or hacking our services, circumventing any security or authentication measures, or attempting to gain unauthorized access to the services, related systems, networks, or data.
- Modifying, disabling, or compromising the integrity or performance of the services or related systems, network or data.
- Deciphering any transmissions to or from the servers running the services.
- Overwhelming or attempting to overwhelm our infrastructure by imposing an unreasonably large load on our systems that consume extraordinary resources (CPUs, memory, disk space, bandwidth, etc.), such as:
- Using “robots,” “spiders,” “offline readers,” or other automated systems to sends more request messages to our servers than a human could reasonably send in the same period of time by using a normal browser.
- Going far beyond the use parameters for any given service as described in its corresponding documentation
Wrongful activities:
- Misrepresentation of yourself, or disguising the origin of any content (including by “spoofing”, “phishing”, manipulating headers or other identifiers, impersonating anyone else, or falsely implying any sponsorship or association with ChromaDiverse or any third party).
- Using the services to violate the privacy of others, including publishing or posting other people’s private and confidential information without their express permission, or collecting or gathering other people’s personal information (including account names or information) from our services.
- Using our services to stalk, harass, or post direct, specific threats of violence against others.
- Using the services for any illegal purpose, or in violation of any laws (including without limitation data, privacy, and export control laws).
- Accessing or searching any part of the services by any means other than our publicly supported interfaces (for example, “scraping”).
Inappropriate communications:
- Using the services to generate or send unsolicited communications, advertising, chain letters, or spam.
- Soliciting our users for commercial purposes, unless expressly permitted by ChromaDiverse.
- Disparaging ChromaDiverse or our partners, vendors, or affiliates.
- Promoting or advertising products or services other than your own without appropriate authorization.
Inappropriate content:
Posting, uploading, sharing, submitting, or otherwise providing content that:
- Infringes ChromaDiverse’s or a third party’s intellectual property or other rights, including any copyright, trademark, patent, trade secret, moral rights, privacy rights of publicity, or any other intellectual property right or proprietary or contractual right.
- You don’t have the right to submit.
- Is deceptive, fraudulent, illegal, obscene, defamatory, libelous, threatening, harmful to minors, pornographic (including child pornography, which we will remove and report to law enforcement, including the National Center for Missing and Exploited Children), indecent, harassing, hateful.
- Encourages illegal or tortious conduct or that is otherwise inappropriate.
- Attacks others based on their race, ethnicity, national origin, religion, sex, gender, sexual orientation, disability, or medical condition.
- Contains viruses, bots, worms, scripting exploits, or other similar materials.
- Is intended to be inflammatory.
- Could otherwise cause damage to ChromaDiverse or any third party.
In this Acceptable Use Policy, the term “content” means: (1) any information, data, text, software, code, scripts, music, sound, photos, graphics, videos, messages, tags, interactive features, or other materials that you post, upload, share, submit, or otherwise provide in any manner to the services and (2) any other materials, content, or data you provide to ChromaDiverse or use with the services.
Without affecting any other remedies available to us, ChromaDiverse may permanently or temporarily terminate or suspend a user’s account or access to the services without notice or liability if ChromaDiverse (in its sole discretion) determines that a user has violated this Acceptable Use Policy.
ChromaDiverse SaaS Data Retention Policy
ChromaDiverse’s standard SaaS offering employs several layers of protection to ensure data retention and application security in the event of a disaster or system malfunction. ChromaDiverse runs a nightly job that mirrors asset changes to a geographically distinct remote storage location. ChromaDiverse attempts to maintain a copy of the current asset state within a window of 24 hours. ChromaDiverse also maintains a copy of assets in the remote storage location even if they have since been deleted from the system. Additionally, ChromaDiverse maintains multiple copies of a client’s assets in our data center for added resiliency.
The following critical components are archived to remote storage:
- Original asset files.
- Database (SQL dump file).
- Main configuration files (files in /netx/config, /solr/netx/config, and optionally other files).
Data that is not included in the archive service:
- Asset View files (database data will exist, but the files themselves are not backed up using this approach).
- Asset Version files (database data will exist, but the files themselves are not backed up using this approach).
- Proxy and ancillary files.
- Custom code or third-party integration configurations.
Terms and Conditions:
- Large volume batch imports may cause data parity between the primary and remote storage mirror to decrease beyond a 24-hour period.
- The standard service that is included with all SaaS subscriptions is intended for use by the Authorized Administrative User to provide application recovery during catastrophic events. These data are not externally accessible by clients.
- Clients that require data restoration due to end-user fault will be billed for time and materials, including all Amazon Web Services data retrieval fees.
- Recovery time for retrieval varies based on amount of data stored, and large restorations could require weeks before completion.
- During a recovery operation, non-critical fixes and enhancement requests are not supported. Client will be solely responsible for issues arising from third party software and customizations to ChromaDiverse programs and services.
Scheduled Maintenance Policy
In order to provide the best possible client experience, ChromaDiverse requires regularly scheduled maintenance windows. Scheduled maintenance may occur on the second and fourth Wednesday of each month between 6:00 pm and 9:00 pm PST. This maintenance provides the opportunity for ChromaDiverse to perform any infrastructure and deployment tasks required to improve or optimize and secure our SaaS infrastructure.
Typically for any given maintenance window, there will be no work to perform. In other situations where work is required, more often than not, only a small number of sites will be affected. If there is a possibility that your ChromaDiverse Services will be affected by the maintenance effort, an email will be sent to you at the Authorized Administrative User’s email address at least one (1) day prior. This email may provide more detail about the expected downtime (if any) for your site during that window. If you do not receive an email you will not be affected by that window’s maintenance.
If you have any questions or concerns, please feel free to open a support ticket.
When is scheduled maintenance?
The second and fourth Wednesday of every month from 6:00 pm to 9:00 pm (Pacific Time).
Sharing Analytics, Diagnostics, and Usage Information with ChromaDiverse
The CD Digital Vault can send diagnostic and other anonymized data to ChromaDiverse for analysis. This datagathering helps us understand what functions and modules are being used more than others. Additionally, it provides various scale data—minimums, maximums and averages to better guide our QA endeavors.
Is the data secure?
ChromaDiverse takes security and privacy very seriously. The data retrieved never includes any Personally Identifiable Information (PII)—names and the like are never sent. Please note: administrative email addresses (from configuration properties) may be included, which may overlap with registered users in some cases. Furthermore, this data falls under ChromaDiverse’s Privacy Policy; therefore, ChromaDiverse will never share this data with any third party. It is only used internally for diagnostic purposes.
What kind of data is collected?
ChromaDiverse is interested in configuration and usage data to address the goals above (including better QA, and guidance for our Product Roadmap). The types of data provided include:
- Scale data: totals for storage, assets, attributes, users, groups, permissions, etc.
- Configuration: various properties set on the system.
- File formats: what is stored and how many of each.
- AutoTasks and DSS: how many and what are they doing?
- User agents: allowing us to understand browser popularity.
- Stats: allowing us to understand usage patterns (this data is anonymized and condensed into simple totals— no specific usage is sent).
Support Policy and Service Uptime Commitment
Contacting support
ChromaDiverse Support may be reached by phone: (415) 515-7000, or by email: support@ChromaDiverse.org. ChromaDiverse support hours are Monday-Friday, 8:00 a.m.- 5:00 p.m. (U.S. Pacific Time zone)
Support includes:
- Incident support—identifying and troubleshooting problems in the software.
- Assistance with issues during installation.
- Assistance with issues during upgrades.
- Identifying and creating needed bug reports.
- Basic guidance around implementation and configuration.
- Integration support with other ChromaDiverse products.
Support does not include:
- Clients without a valid maintenance agreement.
- Support for end-users.
- Product training.
- Support in languages other than English.
- Professional Services such as configuration or consulting.
- System and performance tuning.
- Deployment and capacity planning.
- Installation and upgrade services for On-Premise clients.
- End of Life, Beta, Release Candidate or Development releases.
- Customized versions of ChromaDiverse products (customized means original product code has been modified).
- Development questions or requests (unless a bug in ChromaDiverse’s API is suspected as the root cause).
- Third-party application integrations or third-party plugins.
ChromaDiverse shall be under no obligation to provide Support to clients if ChromaDiverse makes a good faith determination that the primary cause of a bug or reported problem results from the failure or malfunction of any thirdparty or client software, tools, equipment, facilities or devices not furnished by ChromaDiverse for use in connection with the licensed software.
The ChromaDiverse support process
The Support Team will gather the necessary information and determine the next steps required to resolve requests. The Support Team will often be able to find a resolution without consulting other affiliate teams. However, sometimes a request will require Engineering or Product teams to investigate further, and it will be up to those teams to prioritize fixes and feature development. While the Support Team will advocate on behalf of clients, their involvement once a request is escalated to other ChromaDiverse teams will be minimal, providing status updates as they become available.
Support priority levels
While ChromaDiverse attempts to respond to all issues in a timely manner, issues that affect our clients’ production applications (i.e., Level 1, Level 2) take priority. “Production” is defined as an instance of ChromaDiverse software actively used by the client’s business users; it does not include testing systems or production staging systems or environments
Level of Severity
Level 1 – Urgent
Description of Severity & Characteristics
Critical Business Impact: Critical issue occurring on production system preventing business operations. A large number of users are prevented from working with no procedural workaround.
- System hangs or crashes.
- Critical functionality not available.
- Data loss or data corruption.
- Large number of end-users blocked from work.
- Impact is escalating quickly.
Level 2 – High
Significant Business Impact: Major issue occurring on production system severely impacting business. A large number of users are impacted by issue but they are still able to work in a limited capacity.
- Significant performance degradation.
- Important functionality not available.
- Small number of users blocked from work.
- Impact is escalating.
Level 3 – Normal
Minimal Business Impact: Issue causing a partial or non-critical loss of functionality on production system. A small number of users are affected.
- Some system functions not available.
- Minor performance degradation.
- Small number of users impacted.
- Impact is not escalating
Level 4 – Low
Non-Business Impact: issue occurring on non-production system or question, comment, feature request, documentation issue or other nonimpacting issue.
- Incorrect product behavior without impact.
- Product question or enhancement.
Fixing bugs
- ChromaDiverse Support will help with workarounds and bug reporting.
- Critical bugs will generally be fixed in the next patch release.
- Non-critical bugs will be scheduled according to a variety of considerations.
Critical priority for bug fixes is defined as: “production application down or major malfunction causing business revenue loss or high numbers of staff unable to perform their normal functions”. This includes security issues.
Closed support issues
A support issue is deemed closed (but not necessarily resolved) when one or more of the following has occurred:
- The software has been corrected or modified so that it performs in material accordance with the applicable specification in the documentation for the applicable version of the software.
- The client has been advised on how to bypass the error.
- In the case of software, the client has been informed that the correction to the error is in the current or first prior patch/update, release or version of the software.
- In the case of non-critical issues, the client has been informed that the correction to the error will be available through a future upgrade, release or version.
- It has been discovered that the problem falls within an exclusion to support and the client has been notified thereof
Eligibility and software maintenance
Software maintenance covers access to support and software product updates for the corresponding software license. Refer to the End User License Agreement for specific terms of agreement. After the active maintenance period expires, the software will continue to function, but you will no longer be able to access support or software updates (including security bug fixes).
Support is open to the Authorized Administrative User. “Authorized Administrative User” means an individual to whom Client grants access authorization to use the GUI that is an employee, agent, contractor, shareholder or representative of Client. Client shall remain responsible to Provider for the acts or omissions of its Authorized Administrative User. End-users will be redirected to the Authorized Administrative User.
Service Uptime Commitment
We will use commercially reasonable efforts to meet a Service Uptime of 99.95% for our Subscription Service in a given calendar month. All availability calculations will be based on our system records. Notwithstanding anything to the contrary in this Agreement, as Client’s sole and exclusive remedy for failure to meet availability or support commitments, in the event there are two (2) or more consecutive calendar months during which the Service Uptime falls below 99.95% in a given calendar month, Client will be entitled to receive a credit equal to the pro-rated amount of fees applicable to the downtime as measured within two (2) or more consecutive calendar months during which the Service Uptime fell below 99.95%, which credit shall be applied against an invoice or charge for the following renewal Subscription Term, provided Client requests such credit within twenty (20) days of the end of the relevant calendar month.
For the purposes of the foregoing Service Uptime Commitment, the following definitions shall apply:
“Service Uptime” means (total hours in a calendar month – unscheduled maintenance which causes unavailability – Level 1 (Urgent) issue durations – scheduled maintenance – Excluded) / (Total hours in calendar month – scheduled maintenance – Excluded) X 100%.
“Level 1 (Urgent)” means a critical full outage/severe issue that constitutes a catastrophic problem that causes complete inability to use the Service across a significant portion of the production environment (e.g., crash or hang), resulting in production downtime and where there is no workaround or solution to the problem.
“Excluded” means the following: (i) unavailability caused by circumstances beyond our reasonable control, including, without limitation, acts of God, acts of government, emergencies, natural disasters, epidemics, pandemics, flood, fire, civil unrest, acts of terror, strikes or other labor problems (other than those involving our employees), or any other force majeure event or factors; (ii) any problems resulting from Client’s combining or merging the Subscription Service with any hardware or software not supplied by us or not identified by us in writing as compatible with the Subscription Service; (iii) interruptions or delays in providing the services resulting from telecommunications or internet service provider failures outside of our datacenter as measured by our third-party website availability monitoring provider; and (iv) any interruption or unavailability resulting from the misuse, improper use, alteration, or damage of the Subscription Service.
“Subscription Service” or “ChromaDiverse Service” means all of our web-based Digital Asset Management applications, tools and platforms that you have subscribed to by a Service Order or that we otherwise make available to you, and are developed, operated, and maintained by us, accessible via a designated URL, and any ancillary products and services that we provide to you.
“Subscription Term” means the initial term of your subscription to the applicable ChromaDiverse Service, as specified on your Service Order(s), and each subsequent renewal term (if any).