What we commit to

This Service Level Agreement (“SLA”) forms part of every agreement for an Issuer or Distribution Programme, a Dedicated Environment and the network licence under the FLORIS³ Terms of Service. It sets out what we commit to for the availability of the platform, for support, for backup and recovery and for incident handling.

It applies from the start of the programme term (the day of submission to the supervisory authority, or 60 days after Blueprint sign-off at the latest). It does not apply to trials, demo tenants, features marked as beta or preview, or to consulting deliverables such as the Capital Blueprint and the Filing Package, whose deadlines are set in the Terms.

Where an order form sets different service levels, the order form prevails. We may improve this SLA at any time; we will not reduce a service level during a running term without your written agreement.

• Platform — the FLORIS³ client application, the investor portals and widgets we operate for you, and the public API.
• Available — users can log in and the core functions (investor onboarding, subscription, register and cap-table views, document access, distributions, commission statements) respond as documented. A function answering with server errors for more than 5 consecutive minutes counts as unavailable for that period.
• Monthly Availability — (total minutes in the calendar month − Downtime minutes) ÷ total minutes in the month × 100, measured by our external monitoring from at least two EU locations.
• Downtime — minutes in which the Platform is not Available, excluding the Exclusions in section 4.
• Business day / business hours — Monday to Friday, 09:00–18:00 CET/CEST, excluding Austrian public holidays.
• Monthly fees — the programme fee for the month concerned (one twelfth of the annual fee) plus the Dedicated Environment monthly fee, excluding pass-through costs, overage and one-off fees.

We publish availability for the previous month in the client application. Dedicated Environment clients receive a monthly service report with availability, incidents, changes and capacity, and a quarterly service review with their named contact.

Planned maintenance

We schedule maintenance in the window Sundays 00:00–06:00 CET/CEST, announce it at least 5 business days in advance in the client application and by email, and keep it to at most 8 hours per month. Planned maintenance within these limits is not Downtime. Dedicated Environment clients may ask us to move a release within their own release ring by up to two weeks.

Emergency maintenance

We may apply urgent security fixes at any time. We announce them as early as the situation allows. Emergency maintenance counts as Downtime unless it is needed because of a vulnerability disclosed by a third-party supplier and we apply the fix within 72 hours of disclosure.

Not counted as Downtime

• Unavailability caused by you, your users, your advisers or your integrations, including misuse, configuration you made, or exceeding documented limits.
• Failures of public blockchains, wallet providers, register keepers, custodians, identity-verification, e-signature, payment, email or AI providers, and of the public internet.
• Suspension under the Terms (for example for non-payment or an authority’s request).
• Force majeure as defined in the Terms.
• Features marked beta, preview or experimental, and trial or demo tenants.
• Slow performance that does not meet the definition of unavailable.

If Monthly Availability of a Dedicated Environment falls below 99.5 %, you receive a credit on the monthly fees for that month:

• Request a credit in writing within 30 days after the end of the month concerned. We confirm or explain our measurement within ten business days.
• Credits are set off against the next invoice, or refunded if the agreement ends. They are capped at 30 % of the monthly fees for any one month.
• Credits are the financial remedy for missed availability. They do not limit your termination right below, your rights for damages caused by our intent or gross negligence, or your rights under a DORA addendum.

Chronic failure

If Monthly Availability falls below 95.0 % in 2 consecutive months or in 3 months within any twelve, you may terminate the Dedicated Environment — and the programme it hosts — with immediate effect by written notice within 60 days. We refund prepaid fees for the period after termination and provide the exit assistance in section 9 at no charge.

• Named contact — every programme has a named contact at FLORIS³ who knows your structure, offerings and providers.
• Channels — the in-app support channel and hello@floris3.com for all priorities; Priority 1 incidents additionally by the phone number provided at onboarding.
• Hours — Monday to Friday, 09:00–18:00 CET/CEST, excluding Austrian public holidays. Dedicated Environment: 24 × 7 for Priority 1 incidents.
• Language — English and German.

You classify the priority when you report an issue; we may reclassify it with reasons. The response time runs from receipt of a report with enough information to start work, and is met by a qualified engineer acknowledging the issue and starting diagnosis.

Workaround targets are objectives, not guarantees; a permanent fix follows in a scheduled release. Support covers use and operation of the platform. It does not include legal, tax or regulatory advice, structuring work, or remediation of issues caused by your own changes — these are available at the day rates published on /pricing.

We back up platform data automatically, encrypt backups at rest, store them in a separate EU location from the primary data, and test restoration at least twice a year.

RPO is the maximum data loss we design for; RTO is the target time to restore service after a declared disaster. Records written to a public blockchain are not affected by backups and cannot be rolled back. We maintain a business-continuity and disaster-recovery plan and share a summary with Dedicated Environment clients on request.

• We notify you of a personal-data breach affecting your data without undue delay, and at the latest within 24 hours of becoming aware of it, with the information then available — so that you can meet your own 72-hour duty under Article 33 GDPR.
• Where you are a financial entity under the Digital Operational Resilience Act (DORA), we inform you of an ICT incident affecting your services within 4 hours of classifying it as major, and provide the information you need for your initial, intermediate and final reports.
• After every P1 incident we deliver a written root-cause analysis within ten business days.
• We run an independent penetration test of the platform at least once a year and share a management summary on request. Tests commissioned specifically for a Dedicated Environment are charged at cost + 10 %.
• Security issues can be reported at any time to hello@floris3.com.

You can export your data at any time through the client application. At the end of the agreement we provide a complete machine-readable export — investor register, cap tables, subscriptions, documents, KYC references, commission records and audit logs — within 30 days, at no charge.

On request we support the transfer of your programme to you or to a successor provider, including the handover of administrative rights over smart contracts we administer for you. Exit assistance beyond the export is charged at the published day rates, except after a chronic-failure termination under section 5, and is available for up to six months after the end of the agreement.

We provide the information reasonably needed to demonstrate compliance with this SLA and with our data-protection obligations. Dedicated Environment clients receive audit support as part of their fee. Where DORA applies, you, your auditors and your competent authority have the access, inspection and audit rights set out in the DORA addendum to your agreement.

Questions about this SLA: your named contact, or hello@floris3.com.