Service Level Agreement

Effective date: 2026-01-01

1. Purpose

This Service Level Agreement (SLA) defines incident response, resolution targets, and availability objectives for Reactiv Mobile App Builder services.

2. Scope

This SLA applies to the following service categories:

• Dashboard
• Mobile App Platform
• Mobile App Clip Platform (iOS)
• Integration Services
• Data Systems
• AI Services

3. Support Coverage

• 24/7 coverage for critical incidents (Sev0 and Sev1), including weekends and holidays.
• Business hours for Sev2 and Sev3, unless otherwise agreed in writing.
• Business hours: Monday-Friday, 9:00 AM-6:00 PM ET, excluding company holidays.

4. Incident Management

Incidents follow a single path from intake to resolution: they are reported through the support channels below, triaged and assigned a severity by the Customer Success Team, tracked internally, and worked by the on-call engineering rotation. Severity determines the response and communication commitments that apply, as set out in Section 5.

• Incidents are triaged by Customer Success Team via Slack, Live Support Chat, or via support@reactiv.ai
• Internally incidents raised by the Customer Success Team are managed via Rootly.
• Engineering team is split into on-call rotations. On-call engineers are reachable through Slack, SMS, and phone, and are paged directly for emergencies outside business hours.
• Severity is assigned by the Customer Success Team and may be reclassified as new information becomes available.
• Sev0 incidents trigger an immediate all-hands response and executive escalation; see Section 5.
• Communication cadence:
  • Sev0: updates at least every 30 minutes until mitigation, then hourly until resolution.
  • Sev1: continuous updates until resolution.
  • Sev2: daily updates until resolution.
  • Sev3: weekly updates until resolution.

Post-Incident Root Cause Analysis (Post-Mortem)

Every Sev0 and Sev1 incident receives a written root cause analysis (RCA), also referred to as a post-mortem. The RCA requirement does not wait for customer impact to end. For Sev2 incidents, an RCA is optional and is provided on customer request. Sev3 incidents do not require an RCA.

Deadlines are measured from mitigation, meaning the point at which core functionality is restored or a workaround is in place. They run from mitigation even when residual customer impact remains. They are not measured from the permanent fix, so an RCA is never held back while a longer-running fix is completed.

Severity	Preliminary incident summary	Final RCA
Sev0	Within 1 business day	Within 3 business days
Sev1	Within 1 business day	Within 3 business days
Sev2	Within 3 business days	Within 5 business days

Sev2 deadlines apply only when the customer requests an RCA. If the request is made after mitigation, the deadlines run from the date of the request.

The preliminary incident summary is a short notice confirming what happened, the customer impact and duration, and the mitigation applied. It may state that the root cause is still under investigation.

The final RCA covers customer impact and duration, an incident timeline, the identified root cause, the remediation applied, and preventive actions with named owners and target dates. Where the permanent fix is not yet released when the RCA is delivered, it is tracked as a preventive action with a target date.

If an incident is reclassified, the deadlines for its final severity apply, measured from the original mitigation time.

RCAs are delivered through the same channel used for incident communication, typically Slack, with email or the support portal as fallback.

Where the root cause lies wholly or partly with a third-party provider, the turnaround targets above apply to Reactiv's own findings, which are delivered on time regardless of third-party timelines. Information obtainable only from the third party, including that provider's own post-incident report, is excluded from the completeness commitment for the final RCA, and is supplied as a supplement if and when Reactiv receives it.

5. Severity Classification (Dashboard, Mobile, Integration)

Sev0 - Blocked revenue, security incident, or full outage (multiple customers)

Impact: A failure of the same nature as Sev1 — blocked revenue, a security incident, or a full outage — that simultaneously affects multiple customers. Examples include a fleet-wide checkout outage, a platform-wide dashboard or API outage, or a security incident spanning more than one merchant.

Scope: Multiple merchants or fleet-wide.

SLA targets:

• Acknowledgement: within 15 minutes, 24/7.
• Work start: immediately upon detection, before or in parallel with acknowledgement.
• Mitigation: ASAP; restoring core functionality takes precedence over a permanent fix.
• Resolution: continuous effort until fixed.

Operational requirements:

• Incident declaration required, with an incident commander assigned.
• All hands on deck: sprint work stops and any engineer needed is pulled in, regardless of rotation.
• Executive escalation and notification to affected customers.
• Status page updated for the duration of the incident.
• Communication updates at least every 30 minutes until mitigation, then hourly until resolution.
• Post-incident RCA required: preliminary incident summary within 1 business day and final RCA within 3 business days of mitigation (see Section 4).

Sev1 - Blocked revenue, security incident, or full outage (one customer)

Impact: Blocked revenue, a security incident, or a full outage. Includes checkout mechanical failures and discount codes misapplying or not firing. These are treated as Sev1 when the source is Reactiv; when a third-party provider is involved, the incident is triaged to determine whether it is actionable on the Reactiv side.

Scope: A single merchant or a contained subsystem. An incident of this nature affecting multiple merchants is classified Sev0.

SLA targets:

• Acknowledgement: within 1 hour, 24/7.
• Work start: immediately after acknowledgement.
• Resolution: ASAP with continuous effort until fixed.

Operational requirements:

• Incident declaration required.
• Sprint interrupt and top priority for the team.
• Pull in other developers as necessary.
• Continued communication updates until the issue is resolved.
• Post-incident RCA required: preliminary incident summary within 1 business day and final RCA within 3 business days of mitigation (see Section 4).

Sev2 - Core feature unusable, no workaround

Impact: A core feature is unusable and no workaround is available, such as the product page or list screen, the account screen, analytics and reporting, or login.

Scope: Single merchant or a contained subsystem.

SLA targets:

• Acknowledgement: within 1 business day.
• Resolution and release: within the current sprint (typically ~5 days, < 1 week).

Operational requirements:

• Incident declaration required.
• Sprint interrupt.
• Product reprioritization to remove a lower priority item from the sprint.
• Work completed by the support rotation developer or in collaboration with a domain expert.
• Post-incident RCA optional, provided on customer request: preliminary incident summary within 3 business days and final RCA within 5 business days (see Section 4).

Sev3 - Core feature degraded, workaround available

Impact: A core feature is degraded but a workaround is available, such as search or wishlist issues.

Scope: Any scope; most users will not notice.

SLA targets:

• Acknowledgement: within 2 business days.
• Resolution: next sprint (typically ~14 days).

Operational requirements:

• Not a sprint interrupt.
• No post-incident RCA required.
• Support rotation developers may address if capacity and expertise allow; otherwise scheduled with Product for the next sprint.

6. Service Definitions

Dashboard

Dashboard includes the web-based administration experience used to configure and manage the Reactiv platform, including settings, content, integrations, analytics, and reporting.

Mobile App Platform

Mobile App Platform includes the core mobile shopping experience delivered to end users across iOS and Android, including navigation, product discovery, PDP/PLP, cart, checkout, account, and push notifications.

Mobile App Clip Platform (iOS)

Mobile App Clip Platform includes iOS App Clip experiences that enable lightweight, fast entry to key shopping flows such as product views, and quick checkout.

Note: The ClipKit implementation follows the same service level agreements, but the customer is required to deploy the changes once a fix and a new version is available for download.

Integration Services

Integration Services include platform connectors and middleware that enable data and feature exchange with third-party systems such as Shopify, reviews, loyalty, subscriptions, analytics, and support tools.

Data Systems

Data Systems include all components responsible for ingestion, processing, storage, and retrieval of structured and unstructured data, including but not limited to:

• Analytics and reporting systems
• Data warehouses and data lakes
• Data processing and transfer, ETL / ELT jobs and schedulers
• Data APIs and internal data services

AI Services

AI Services include systems that generate predictions, recommendations, or content using machine learning or large language models, including:

• AI Agent infrastructure
• AI Studio Prompt orchestration
• Model inference services
• Merchant Knowledge Bases

7. SLA Tiers

Dashboard, Mobile App Platform, Mobile App Clip Platform (iOS), Integration Services

Tier	Description	Scope	Example	Acknowledgement	Resolution/Release
Sev0	Blocked revenue, security incident, or full outage (multiple customers)	Multiple merchants or fleet-wide	Fleet-wide checkout outage, platform-wide outage, multi-merchant security incident	<= 15 minutes, 24/7	ASAP, all hands until fixed
Sev1	Blocked revenue, security incident, or full outage (one customer)	Single merchant or a contained subsystem	Checkout failures, discount codes failing	<= 1 hour, 24/7	ASAP with continuous effort until fixed
Sev2	Core feature unusable, no workaround	Single merchant or a contained subsystem	Product page or list screen, account screen, analytics and reporting, login	<= 1 business day	Within current sprint (typically ~5 days)
Sev3	Core feature degraded, workaround available	Any scope; most users will not notice	Search issues, wishlist issues	<= 2 business days	Next sprint (typically ~14 days)

Data and AI Services

Tier	Description	Example	Acknowledgement	Mitigation
Sev0	Critical, multi-customer	AI or Data services unavailable across multiple merchants	<= 15 minutes	<= 4 hours
Sev1 (AI)	Mission-critical	AI Studio Agent unavailable	<= 1 hour	<= 24 hours
Sev1 (Data)	Mission-critical	Data not available or stale data	<= 1 hour	<= 48 hours
Sev2	Business-critical	Data not accurate, AI Studio Agent reliability	<= 1 business day	<= 1 week
Sev3	Non-critical	General bugs	<= 2 business days	<= 2 weeks

8. Availability Targets

Availability is measured monthly and excludes approved maintenance windows.

System	Trigger Threshold
Dashboard	99.95%
Mobile App Platform	99.95%
Mobile App Clip Platform (iOS)	99.95%
Integration Services	99.95%
Data Systems	99.7%
AI Services	99.7%

Approximate downtime per year (based on 8,760 hours/year):

• 99.95%: ~4.4 hours
• 99.9%: ~8.8 hours
• 99.7%: ~26.3 hours
• 99.5%: ~43.8 hours
• 99.0%: ~87.6 hours

9. Business Continuity & Disaster Recovery

Business Continuity

• During service disruptions, customers are notified via the Reactiv Status Page and directly through Slack where configured, with email or the support portal used as a fallback for customers without Slack integration.
• An on-call engineering rotation is maintained to respond to incidents and coordinate continuity efforts.
• The business continuity plan is reviewed and tested at least annually.

Recovery Time & Recovery Point Objectives

Service	RTO	RPO
Dashboard	4 hours	24 hours
Mobile App Platform*	4 hours	24 hours
Mobile App Clip Platform (iOS)*	4 hours	24 hours
Integration Services	4 hours	24 hours
Data Systems	24 hours	48 hours
AI Services	24 hours	48 hours

*RTO for Mobile App Platform and Mobile App Clip Platform (iOS) may be extended by Apple and Google app review processes for fixes that require a native app update.

Redundancy

All production services are deployed across multiple availability zones (multi-AZ) within AWS us-east-1 (Northern Virginia). This provides resilience against individual zone failures within the region. Cross-region failover is not currently in scope.

Backup Schedule

Frequency	Retention
Daily	35 days
Weekly	90 days
Monthly	1,825 days (5 years)

Recovery Procedures

Documented recovery procedures are maintained internally and tested as needed to ensure operational readiness.

10. Maintenance Windows

Planned maintenance windows will be scheduled in advance when possible and communicated to affected customers. Emergency maintenance may be performed as needed to protect system stability and security.

11. Exclusions

This SLA does not apply to issues caused by:

• Third-party services outside Reactiv control
• Customer code, configuration, or content
• Network or infrastructure failures outside Reactiv control
• Force majeure events

12. Definitions

• Acknowledgement: Confirmation that the incident has been received, classified, and assigned.
• All hands on deck: The Sev0 response posture in which sprint work is suspended and any engineer required to mitigate the incident is assigned to it, independent of the on-call rotation.
• Core feature: Functionality required to complete a primary task in one of the services defined in Section 6, such as browsing or searching products, viewing a product, completing checkout, signing in, or accessing analytics and reporting.
• Incident commander: The individual accountable for coordinating a Sev0 response, including engineering effort, customer communication, and executive escalation.
• Mitigation: Restoring core functionality or providing a workaround to reduce impact.
• Resolution: Permanent fix applied to the root cause.
• Release: Deployment of the fix to production or customer-facing systems.
• Root Cause Analysis (RCA): The written post-incident review, also called a post-mortem, required for Sev0 and Sev1 incidents and provided for Sev2 incidents on customer request. It covers customer impact, incident timeline, identified root cause, remediation applied, and preventive actions, as set out in Section 4.
• Security incident: For the purposes of severity classification, a confirmed event in which customer data was accessed, disclosed, altered, or destroyed without authorization, or in which the integrity of Reactiv's production systems was compromised. Suspected or attempted incidents that are contained without such access, and vulnerabilities identified before exploitation, are classified by their observed impact against the criteria in Section 5, including Sev0 or Sev1 where that impact blocks revenue or causes a full outage. Sev2 or Sev3 applies only where the event meets no higher-tier criterion. This definition governs severity assignment only and does not alter the personal data breach notification obligations set out in the Data Processing Addendum.

13. System Health

Reactiv System Health is available at https://status.reactiv.ai/