SLA and scope
What an OSSeva contract covers
The OSSeva software support SLA sets patch times and response times by tier. Critical CVEs (CVSS 9.0 or higher) are patched within 48 hours and High within 7 days, on every technology. Operate adds 24/7 monitoring and a 15-minute P1 response. Assure adds 24/7 reactive support. Scope, exclusions and the evidence each build carries are below.
- Critical CVE patch
- Within 48 hours (CVSS 9.0 or higher)
- High CVE patch
- Within 7 days
- P1 response
- 15 minutes, 24/7, with a 4-hour resolution target (Operate)
- 24/7 reactive support
- Assure and Operate
- Applies to
- Every technology on the supported versions list
- Measures
- Patch, response and resolution times. No uptime percentage
Last reviewed
SLA matrix by tier
A service level agreement for software support has to say what is measured, for which severity and from which tier. The patch window is the same on every tier. The tiers differ in the support around it.
| Tier | Patch commitment | Support hours and response | People and reviews |
|---|---|---|---|
| Patch | Critical within 48 hours, High within 7 days, everything else in a quarterly batch | 24/7 support is not part of Patch. You get disclosure notifications and a CVE record per build. | None included |
| Assure | Same patch window | 24/7 reactive support, weekends and holidays included: raise an issue at any hour and an engineer works it with you. Assure does not monitor or run your clusters. This page publishes no response-time figure for Assure, so ask for it in writing. | Named architecture consultant, annual architecture audit, upgrade planning |
| Operate | Same patch window | 24/7 monitoring and on-call, with escalation to senior OSSeva engineers. P1 response in 15 minutes, 24/7. | Named senior engineer, quarterly business reviews |
Operate response and resolution by severity
Operate sorts every incident into four severity levels. Response is how fast an engineer engages. The resolution target is how fast the issue is fixed.
| Priority | Definition | Response | Resolution target |
|---|---|---|---|
| P1 | Production down or data loss risk | 15 minutes | 4 hours |
| P2 | Significant degradation, no immediate outage | 1 hour | 8 hours |
| P3 | Non-critical issue, workaround available | 4 hours | 2 business days |
| P4 | Question, advisory or enhancement request | 1 business day | Scheduled sprint |
Every Operate incident gets a post-mortem and a prevention plan.
CVE patch commitments by severity
| Severity | Patch commitment | Notes |
|---|---|---|
| Critical (CVSS 9.0 or higher) | Within 48 hours | Out-of-cycle release, signed build with SBOM, VEX statements and a CVE record. |
| High | Within 7 days | Same delivery and evidence as Critical. |
| Medium and low | Quarterly batch | Emergency hotfixes for actively exploited vulnerabilities. |
The same window applies to every technology on the supported versions list. Two terms decide what a patch window is worth: when the clock starts and which CVSS scores count as High. This page publishes neither, so ask for both in writing.
What a software support SLA should include
Compare any support agreement against the same eight elements. The last column shows where this contract states each one.
| Element | What to look for | In the OSSeva contract |
|---|---|---|
| Support hours | 24/7 or business hours, and whether weekends and holidays count | 24/7 on Assure and Operate. Not part of Patch. |
| Severity levels | A written definition for each level | P1 to P4 in the Operate table above. |
| Response and resolution times | A target for each severity level, and when each clock starts | Operate table above. No Assure figure is published. |
| Patch times | A time per CVE severity | Critical 48 hours, High 7 days. |
| Escalation | A named path to senior engineers | Operate has on-call escalation to senior OSSeva engineers and a named senior engineer. |
| Remedies for a missed target | Service credits or another remedy | No schedule published. See service credits below. |
| Reporting and review | A regular review of incidents and trends | Operate has quarterly business reviews and a post-mortem for every incident. |
| Exclusions | What the agreement does not cover | Listed below. |
Scope: what the contract covers
| Item | What is covered |
|---|---|
| Versions | Current and end-of-life versions on the supported versions list. Bringing a system under support does not force an upgrade first. |
| Technologies | Databases, brokers and runtimes on one contract. The technologies page lists every version. |
| Builds | Backported CVE fixes as signed drop-in builds that apply to upstream source with no fork, delivered through Artifactory, Nexus or Harbor, or a Helm, Maven Central or OCI registry. |
| Compatibility | Erlang/OTP, JVM and glibc compatibility is validated for the builds. |
| Where it runs | Your data centre, your cloud account or your Kubernetes clusters. The infrastructure and the data stay yours. |
| Operate | Monitoring, incident response, runbooks written for your clusters, capacity planning, rolling upgrades executed node by node and patch deployment coordination. |
What is not covered, and when this SLA is not a fit
Databases hosted for you
OSSeva supports software you run on your own infrastructure, so this SLA measures patch, response and resolution times, not the uptime of a hosted service. It publishes no uptime percentage. A managed service from your cloud provider fits better if you want the vendor to host the database.
Versions outside the supported list
The patch window applies to the versions listed on the supported versions page. Check your exact version there first.
Proprietary distributions
Oracle-compatible PostgreSQL, MySQL Enterprise components and Redis Software's Active-Active replication belong with the vendor that builds them.
A CVE with no upstream fix
There is nothing to backport, so the build is not marked fixed. The VEX statement stays affected and the CVE record documents a configuration mitigation where one exists.
Work a tier does not include
On Patch you deploy the build yourself. Assure does not monitor or run your clusters. A Dedicated Partner is engineering capacity, not the pager, so pair it with Assure or Operate for 24/7 cover.
Service credits
This page does not publish a service credit schedule. Ask for the credit terms in writing, as you would with any supplier: what credit applies if a target is missed, when each clock starts and stops, and how a missed target is measured. The procurement guide lists these questions among the six to put to every vendor.
Evidence pack: what ships with each build
An SLA is easier to audit when each commitment leaves a record. Every patched build ships with:
- A signed artifact, using GPG for packages and Maven artifacts and cosign for container images, with SHA-256 checksums.
- An SBOM and VEX statements that say per CVE whether it is fixed, not affected or under investigation.
- A CVE record with the CVSS score, affected versions, delivery date and build identifier.
- For Assure, compliance documentation written for SOC 2, HIPAA, PCI DSS and ISO 27001 audits.
The trust center explains how builds are signed and how to verify them. The audit acceptance guide shows how auditors read this evidence. To see the terms in writing, ask for the contract terms.
What shapes the contract
OSSeva prices per cluster, not per core, and publishes no price. The quote follows the units in scope, the versions you run, the tier, whether you need 24/7 cover and the evidence your auditors ask for. The pricing page lists the unit for each technology.
How fast do you patch a critical CVE?
Within 48 hours for Critical CVEs, meaning CVSS 9.0 or higher, and within 7 days for High. The window is the same on every tier and for every technology on the supported versions list. Medium and low issues go into a quarterly batch, with emergency hotfixes for actively exploited vulnerabilities.
What is not covered?
Databases hosted for you, versions outside the supported list, proprietary distributions such as Oracle-compatible PostgreSQL, and CVEs with no upstream fix, which stay marked affected in the VEX statement. On Patch you deploy the build yourself, and Assure does not monitor or run your clusters.
Do you offer service credits?
This page publishes no service credit schedule. Ask for the credit terms in writing during the discovery call, along with when each clock starts and stops.
What is the difference between response time and resolution time?
Response time is how long until an engineer engages with the incident. The resolution target is how long until it is fixed. On Operate a P1 incident has a 15-minute response and a 4-hour resolution target, and a P2 has a 1-hour response and an 8-hour target.
Do you guarantee uptime?
No uptime percentage is published. Uptime figures such as 99.9% describe how much downtime a hosted service allows, and OSSeva does not host your software. The SLA measures patch, response and resolution times for software that runs on your own infrastructure.
Get a quote
Get the contract terms in writing.
See the terms in writing, then talk through your estate on a 15-minute call. The quote is priced per cluster.