Rock15 Digital Brain – Service Level Agreement
1. Parties, purpose and term
This Service Level Agreement (“SLA”) is made between Rock15 Co Inc., a Delaware corporation, [address] (“Rock15”), and [Customer legal name], [address] (“Customer”).
It sets the service levels, data commitments and support Rock15 provides for the Rock15 Digital Brain platform, how they are measured, and the remedies when they are missed. It supplements the Rock15 Digital Brain Terms of Service and the order form or enterprise agreement dated [date] (together, the “Agreement”). Where this SLA conflicts with the Agreement on service levels, data handling or AI use of Customer Data, this SLA prevails.
- Effective date: [date of subscription]
- Term: coterminous with Customer’s paid subscription under the order form. This SLA does not apply to Trial Services (Terms of Service, Section 4).
- Definitions:
- “Customer Data” means all documents, content and data that Customer or its Authorized Users upload, connect or enter, including the document chunks and embeddings derived from them, Customer’s knowledge graph instance, user prompts and AI agent answers.
- “Workspace” means the logically isolated environment provisioned for Customer, holding its Customer Data and accessible only to its Authorized Users.
- “Authorized Users” means the employees and contractors Customer designates to use the Services.
- “Business Hours” means [09:00–18:00 in Customer’s designated time zone, Monday–Friday, excluding public holidays].
- “Month” means a calendar month. “Incident” means any unplanned interruption or degradation of the Services.
2. Scope of services
This SLA covers the production components of Rock15 Digital Brain (the “Services”), all hosted on Microsoft Azure:
| Component | What it does |
|---|---|
| Enterprise architecture knowledge graph | Hosts Customer’s enterprise architecture model as a knowledge graph built on Rock15’s proprietary business process model ontology |
| Document ingestion and vector store | Accepts Customer’s business documents, chunks and embeds them, and stores them in a Workspace-specific vector database for retrieval-augmented generation (RAG) |
| AI agents | Answer Authorized Users’ questions using only Customer’s own document chunks and Customer’s own knowledge graph |
| Workspace and governance | User and role management, access permissions and data visibility controls for Customer’s Authorized Users |
| Support | Incident handling and service requests under Section 4 |
Not covered: Trial Services, beta or preview features, Customer’s own systems and third-party integrations (Terms of Service, Section 9), and Customer-specific development work unless agreed in an order form.
3. Service levels
Rock15 commits to [99.9]% monthly availability for the Services as a whole, measured at the Workspace, plus the targets below.
| Metric | Target | Measured how |
|---|---|---|
| Availability (knowledge graph, AI agents, Workspace) | ≥ [99.9]% per Month | Synthetic monitoring from outside Rock15’s Azure region every [1] minute |
| AI agent first response | [95]% of answers begin streaming in < [10] seconds | Application telemetry, monthly |
| Knowledge graph queries | [95]% complete in < [2] seconds | Application telemetry, monthly |
| Document ingestion | [95]% of documents up to [50] MB chunked, embedded and searchable within [1] hour of upload | Ingestion job logs |
| Backups | Knowledge graph and vector store backed up daily, retained [30] days, in the same jurisdiction as the primary data | Azure backup reports |
| Recovery point objective (RPO) | ≤ [24] hours | Restore test [annually] |
| Recovery time objective (RTO) | ≤ [8] hours | Restore test [annually] |
Availability is calculated as:
“Downtime” means minutes in which Authorized Users cannot sign in to the Workspace, query the knowledge graph or get answers from the AI agents, as recorded by Rock15’s monitoring. Excluded events (Section 5) do not count. At 99.9%, the allowance is about 43 minutes of Downtime in a 30-day Month.
The latency targets cover the platform’s response, not the quality of AI answers. AI output is probabilistic; its accuracy is governed by Terms of Service, Section 8, and is not a service level.
4. Support and incident response
Customer’s designated administrators report Incidents via [support portal / support@rock15.com]. Priority 1 Incidents must also be reported by phone at [number]. Rock15 assigns priority on receipt; Customer may ask for a change with reasons.
| Priority | Definition | Support hours | First response | Target resolution or workaround |
|---|---|---|---|---|
| P1 – Critical | Workspace unavailable, AI agents or knowledge graph unusable for all users, or suspected security breach | 24/7 | [1 hour] | [4 hours] |
| P2 – High | Major function impaired for many users, such as when document ingestion stops or agent answers fail; workaround is difficult | 24/7 | [2 hours] | [1 business day] |
| P3 – Medium | Partial impairment, such as slow ingestion or a graph view error; reasonable workaround exists | Business Hours | [4 business hours] | [5 business days] |
| P4 – Low | Question, cosmetic issue, ontology or feature request | Business Hours | [1 business day] | [Next scheduled release] |
Response time runs from receipt of a complete report. For P1 and P2, Rock15 sends status updates every [2] and [8] hours, respectively, until resolved, and a root-cause report within [5] business days of resolution. Support staff access Customer Data only when needed to resolve a ticket and only with Customer’s permission given in that ticket.
5. Maintenance and exclusions
Planned maintenance runs in a window set for Customer’s hosting region, by default [Sundays 01:00–05:00 local time of the Azure region], with at least [5] business days’ notice. It is capped at [6] hours per Month; maintenance beyond the cap counts as Downtime. Emergency maintenance to fix a security or stability risk may happen at any time, with as much notice as practical.
The following do not count as Downtime:
- Planned maintenance within the agreed window and cap
- A region-wide Microsoft Azure outage affecting the services Rock15 depends on, as confirmed on the Azure status page, provided Rock15 follows its continuity plan in Section 7. [Delete this exclusion if Rock15 chooses to carry Azure risk itself.]
- Failures caused by Customer’s systems, network, identity provider, configuration or misuse, or by acts of Authorized Users
- Delays in ingesting documents that are corrupt, password-protected, over the size limit or in unsupported formats
- Failures of internet or telecommunications providers outside Rock15’s control
- Force majeure events as defined in the Agreement
- Suspension of the Services under the Agreement (for example, for non-payment or breach of the Terms of Service)
6. Customer Data, isolation and AI use
Customer owns its Customer Data. Rock15 processes it only to provide the Services to Customer, and never to train or improve AI models or Rock15’s services.
Workspace isolation. Each customer’s documents, chunks, embeddings and knowledge graph instance sit in a dedicated Workspace. They are logically separated from every other customer’s data at the storage, index and query layers. AI agents retrieve only from the asking user’s own Workspace and only from content that user is permitted to see. No Customer Data is used to answer another customer’s users.
No training, no service improvement. Rock15 does not use Customer Data, prompts or AI answers to train, fine-tune, evaluate or improve any AI model, the ontology or the Services. Rock15’s contracts with its AI model and cloud providers prohibit the same use by them. Rock15 runs its AI models through Microsoft Azure under terms that exclude training on, or retaining, prompts and outputs beyond what is needed to deliver the response [and abuse monitoring, if not waived]. This paragraph replaces any broader use permitted by Terms of Service, Section 5.
Data residency. Customer chooses its hosting jurisdiction at onboarding from Rock15’s supported Azure regions: [EU (Germany West Central / West Europe), United States, United Kingdom, Switzerland, other]. Customer Data at rest, including backups, document chunks, embeddings and the knowledge graph, stays in that jurisdiction. AI processing takes place in the same jurisdiction [or the nearest region offering the required model, as disclosed in the order form]. Rock15 will not move Customer Data out of the chosen jurisdiction without Customer’s prior written consent.
Ownership of the model layers. The business process model ontology, its schema and Rock15’s software remain Rock15’s property (Terms of Service, Section 6). The content Customer puts into its knowledge graph instance, and everything derived from Customer’s documents, is Customer Data.
Export and deletion. Customer may export its documents and knowledge graph content at any time in [JSON / RDF / CSV] format. After the subscription ends, Rock15 keeps Customer Data available for export for [30] days, then deletes it, including embeddings and backups, within a further [30] days, and confirms deletion in writing on request.
Personal data. Where Customer Data includes personal data, the parties’ Data Processing Agreement applies, including for GDPR and other applicable data protection laws.
7. Security, hosting and continuity
The whole Rock15 Digital Brain stack runs on Microsoft Azure, which Rock15 uses as its infrastructure subprocessor. Rock15 stays responsible to Customer for the Services, including the parts Azure provides.
- Encryption: Customer Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256 via Azure-managed keys [or customer-managed keys in Azure Key Vault, if ordered]).
- Access control: Authorized Users sign in through [Microsoft Entra ID single sign-on / Customer’s identity provider] with multi-factor authentication. Rock15 staff access production systems only on a least-privilege, logged, just-in-time basis.
- Subprocessors: Microsoft Azure (hosting, storage, AI model inference) and [others]. Rock15 keeps a current list at [URL] and gives [30] days’ notice before adding one, so Customer can object.
- Certifications: Azure’s ISO 27001, SOC 2 and other attestations cover the infrastructure layer. [Rock15’s own certifications or audit reports, if any.] Rock15 shares these on request under NDA.
- Security incidents: Rock15 notifies Customer without undue delay, and in any case within [48] hours, of confirming unauthorized access to Customer Data. The notice describes the data affected, the likely impact and the steps taken.
- Continuity: Customer Data is stored zone-redundantly within the chosen Azure region. If the region fails, Rock15 restores service within the RTO and RPO in Section 3, using a paired region inside the same jurisdiction where one exists.
- Penetration testing: an independent penetration test at least [annually]; a summary of findings is available to Customer on request.
8. Service credits
If monthly availability falls below target, Customer receives a credit against that Month’s subscription fee:
| Monthly availability | Credit (% of monthly fee) |
|---|---|
| < [99.9]% but ≥ [99.5]% | [5]% |
| < [99.5]% but ≥ [99.0]% | [10]% |
| < [99.0]% but ≥ [95.0]% | [25]% |
| < [95.0]% | [50]% |
- Customer must request the credit in writing within [30] days after the end of the affected Month.
- Credits are applied to the next invoice and are not paid out in cash, except on termination, when unused credits are refunded.
- Total credits in a Month are capped at [50]% of that Month’s fee.
- If availability falls below [95.0]% in [3] consecutive Months, or any [2] P1 Incidents miss their resolution target in a quarter, Customer may terminate the subscription without penalty on [30] days’ notice and receive a pro-rata refund of prepaid fees.
- Service credits are Customer’s sole monetary remedy for missed service levels. They do not limit remedies for breach of Section 6 or Section 7, which remain subject to the liability terms of the Agreement (Terms of Service, Section 13).
9. Customer responsibilities
9.1 Customer responsibilities
Rock15’s commitments depend on Customer doing the following:
- Name at least two Workspace administrators who manage Authorized Users, roles and permissions, and report Incidents
- Keep the list of Authorized Users current and remove access promptly when someone leaves
- Set document-level permissions so that AI agents only surface content each user is entitled to see
- Upload only data it has the right to process, and no sensitive personal data, classified material or regulated data unless agreed in writing (Terms of Service, Section 8)
- Review AI agent answers before relying on them for business decisions
- Report Incidents promptly, with enough detail to reproduce them
- Keep its own identity provider, network and integrations in working order
Delays caused by Customer not meeting these responsibilities pause the response and resolution clocks.
9.2 Protection of Rock15 structures and content
Customer shall not, and shall ensure its Authorized Users do not: (a) reverse engineer, decompile, disassemble or otherwise attempt to derive the source code, algorithms, data models or internal logic of the Services; (b) copy, extract, reconstruct or document the structure, classes, relationships, taxonomy or schema of Rock15’s business process model ontology or of the knowledge graph framework, except as needed for Customer’s internal use of its own Customer Data; (c) attempt to obtain the system prompts, agent instructions, retrieval logic or model configurations of the AI agents, including through prompt injection or systematic or automated querying; (d) use scraping, bots or bulk export to collect Rock15 content or structures; (e) use the Services, their outputs or any knowledge of the ontology to build, train or benchmark a competing product or model; or (f) publish benchmark or performance results without Rock15’s prior written consent. Customer Data and Customer’s export rights under Section 6 are not restricted by this Section 9.2. Exports may present Customer Data without disclosing Rock15’s proprietary ontology beyond what is needed to interpret that data. Breach of this Section 9.2 is a material breach, entitles Rock15 to seek injunctive relief, and is excluded from the liability cap in the Agreement.