Service Level Agreement

Section 1

Uptime commitments

Obsidia commits to the following monthly uptime targets, measured against the public status page. Uptime is calculated as the percentage of minutes in a calendar month during which the service is available to end users, excluding scheduled maintenance windows.

Standard Tier

99.5%

Approximately 3 hours 36 minutes of allowable unplanned downtime per calendar month.

Supabase + Netlify infrastructure Sydney region data residency Business-hours P1 support

Compliance Tier
99.9%
Approximately 43 minutes of allowable unplanned downtime per calendar month.

        AWS infrastructure (ap-southeast-2)
        Multi-AZ redundancy
        24×7 P0 support coverage
      

Scheduled maintenance — Obsidia will provide at least 7 days' advance notice of scheduled maintenance windows via the status page and email to account contacts. Scheduled maintenance windows are excluded from the uptime calculation.

Section 2

Service credits

If Obsidia fails to meet the applicable monthly uptime commitment, the customer is entitled to a service credit applied against the next invoice. Credits must be claimed within 30 days of the end of the affected month by emailing support@obsidia.com.au with the incident reference.

Monthly uptime achieved	Credit (% of monthly fee)	Notes
≥ 99.5% (Standard) / ≥ 99.9% (Compliance)	No credit	SLA met
< 99.5% but ≥ 99.0%	10%	Up to ~7h 18m downtime
< 99.0% but ≥ 95.0%	25%	Up to ~36h downtime
< 95.0%	50%	More than ~36h downtime

Total credits in any calendar month are capped at 100% of the monthly fee for the affected service tier. Credits are the customer's sole and exclusive remedy for SLA failures and do not affect other rights under the subscription agreement.

Section 3

Incident response times

Response time is the time from when Obsidia becomes aware of an incident to when an engineer acknowledges and begins active investigation. These are response commitments, not resolution commitments — resolution time depends on the nature of the incident.

P0 — Critical

Service down for all users

2 hours

24×7 — Compliance tier. Business hours — Standard tier.

P1 — High

Major degradation or partial outage

4 hours

Business hours AEST/AEDT only. Both tiers.

P2 — Medium

Minor issue, workaround available

1 business day

Business hours AEST/AEDT only. Both tiers.

P3 — Low

Feature request or cosmetic issue

Best effort

Reviewed and prioritised against roadmap.

Section 4

Support hours

Priority	Standard Tier	Compliance Tier
P0 — Critical	Business hours AEST/AEDT Mon–Fri 9am–6pm	24 × 7 × 365
P1 — High	Business hours AEST/AEDT	Business hours AEST/AEDT
P2 / P3	Business hours AEST/AEDT	Business hours AEST/AEDT

Business hours are Monday to Friday, 9:00am to 6:00pm Australian Eastern Standard Time (AEST) or Australian Eastern Daylight Time (AEDT), excluding Australian public holidays.

Support is provided via support@obsidia.com.au. Customers on the Compliance tier may also contact their designated account manager directly for P0 incidents outside business hours.

Section 5

Data sovereignty

Obsidia commits that all customer data is stored and processed within Australia:

5.1

Storage region

All customer data — including conversation content, uploaded documents, workflow outputs, and audit logs — is stored in the AWS ap-southeast-2 region (Sydney) on the Compliance tier. On the Standard tier, Obsidia provisions Supabase in the Oceania (Sydney) / ap-southeast-2 region and does not enable features that would replicate data outside Australia. Obsidia is in the process of obtaining formal written data residency commitments from Standard tier sub-processors.

5.2

Processing

AI inference on the Compliance tier is performed exclusively using AWS Bedrock (ap-southeast-2) — all processing remains in Australia. On the Standard tier, queries are processed using the Anthropic API and embeddings via Voyage AI, both of which operate outside Australia. Anthropic does not use API customer data for model training. Obsidia has opted out of Voyage AI's model training programme per client account.

5.3

Cross-border transfers

On the Standard tier, data is transmitted to Anthropic (USA) for AI inference and to Voyage AI (USA) for embeddings. All other customer data remains in Australia. Customers with strict cross-border transfer restrictions should use the Compliance tier. See the Sub-Processor Register for the full list of sub-processors and their data handling details.

Section 6

Breach notification

6.1

Notification to affected customers

In the event of a security incident that results in, or is reasonably likely to result in, unauthorised access to or disclosure of customer data, Obsidia will notify the affected customer by email within 72 hours of confirming the incident, or as soon as practicable.

6.2

OAIC NDB compliance

Obsidia is subject to the Australian Privacy Act 1988 and the Notifiable Data Breaches (NDB) scheme. Where an incident constitutes an eligible data breach under s 26WE of the Privacy Act, Obsidia will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with its published incident response process.

6.3

Post-incident report

For P0 and P1 security incidents, Obsidia will provide a post-incident report to affected customers within 5 business days of resolution, covering the timeline, root cause, and remediation actions taken.

Section 7

Measurement & reporting

7.1

Status page

Obsidia maintains a public status page that is the authoritative record of service availability. Uptime calculations for credit purposes are based on incidents logged on the status page during the relevant calendar month.

7.2

Monthly reporting

Customers may request a monthly uptime report by emailing support@obsidia.com.au. The report will include uptime percentage, a list of incidents, and total credit entitlement (if any) for the period.

7.3

Dispute resolution

If a customer disputes the uptime calculation, they must notify Obsidia within 30 days of receiving the monthly report. Disputes are resolved by reference to the status page incident log. Obsidia's determination is final in the absence of manifest error.

Section 8

Exclusions

The following are excluded from the uptime calculation and do not give rise to credit entitlements:

Scheduled maintenance — announced at least 7 days in advance via the status page and email.
Force majeure — events beyond Obsidia's reasonable control, including natural disasters, acts of war or terrorism, government orders, or widespread internet infrastructure failures.
Customer-caused incidents — outages or degradation caused by the customer's actions, including misconfigured integrations, exceeded rate limits, or actions by the customer's users.
Third-party sub-processor outages — outages attributable to AWS, Supabase, Netlify, or Anthropic, where Obsidia has taken reasonable mitigations and the incident is outside Obsidia's control. Obsidia will still use reasonable endeavours to remediate and communicate.
Beta features — features explicitly designated as beta or preview are provided without uptime commitments.
Free plans — this SLA applies only to paid subscriptions. Free tier access is provided on an as-available basis.

Section 9

General terms

9.1

Relationship to subscription agreement

This SLA forms part of the agreement between Obsidia and the customer. In the event of conflict between this SLA and the subscription agreement, the subscription agreement prevails unless this SLA expressly states otherwise.

9.2

Amendments

Obsidia may update this SLA with 30 days' notice. Customers will be notified by email to the account contact address. Continued use of the service after the notice period constitutes acceptance of the updated SLA. Where an update reduces a customer's entitlements, the customer may terminate within the notice period without penalty.

9.3

Governing law

This SLA is governed by the laws of New South Wales, Australia. Each party submits to the non-exclusive jurisdiction of the courts of New South Wales.

9.4

Contact

For questions about this SLA, contact legal@obsidia.com.au. For support or credit claims, contact support@obsidia.com.au.

9.5

Service Outputs and Customer Responsibilities

Workflow outputs generated by the Service are intended to assist the customer's compliance and legal work. They are not substitutes for professional judgement. The customer remains responsible for reviewing workflow outputs before relying on them or submitting them to regulators or other parties, exercising professional judgement over recommendations, and verifying citations and source attributions in outputs. Service performance metrics reflect platform processing time, not the time required for professional review.

9.6

Sustained Engagement and Output Quality

The Service is designed for sustained customer engagement. Output quality, compliance reporting completeness, and audit trail defensibility depend on regular workflow usage in line with the customer's compliance program, compliance log entries created at the time of underlying events, and knowledge base maintenance via the established quarterly cycle. Episodic or sporadic usage may not realise the full Service value.