SpecificationIntroductionAs part of the vFairs platform, the Provider (“vFairs”) provides:• A Hosting Service with related components. vFairs solution is hosted on Amazon AWS with zonelocated in us-east-1d -North Virginia, USA• A Maintenance service for the Application and Platform including both corrective maintenance andenhancements.• A Customer Support Service for the Application and PlatformThis document outlines the terms under which these services are offered and the associated servicelevels.1. Hosting Services1.1 CUSTOMERENVIRONMENT DEFINITIONCustomer ResourcesAs part of the Hosting Service and platform, each customer will have the following resources:ResourcesAvailabilityApplicationDedicated Application Server InstanceYesApplication Database management (monitoring, tuning, configuration, backup/recovery)YesCustomer dataDedicated logically segregated database structureYesDedicated database access poolsYesDedicated access logsYesNetwork resourcesDelivery of contents using specialized CDN service provider for the hosted site imagesand client side scriptsYesSecurity behind redundant FirewallsYesAvailability using redundant load balancersOptionalHosting InfrastructureSecured Facility (24X7) surveillance, secured access, motion detectorsYesRedundant power (grid power supply, UPS, Power breakers, Parallel Battery, Dieselpower generators)YesRedundant first Tier carriersYes1.2 SERVICE AVAILABILITYvFairs will take all appropriate measures in terms of redundancy, monitoring and platformmanagement so as to guarantee the following service availability outside of planned maintenancewindows as described in this document:Service Availability*0:00-0:00 (GMT), Monday to Friday99.95 %0:00-0:00 (GMT), 7 days a week99 *As measured over a contract subscription period and does not include scheduled maintenance time.The Service is deemed unavailable when access to the login page is not possible from all public networks and confirmed byvFairs technical staff.2. Security Infrastructure2.1 DATA PRIVACYvFairs will constantly ensure the use of the latest state-of-the art technology and procedures at itsdisposal to guarantee the security of the data hosted.2.2 SECURITY INFRASTRUCTUREThe following section provides details of current security infrastructure at vFairs’s hosting facilitieswhich includes:• Intrusion detection services• Security monitoring• Security enforcement• Back up services• Restricted Physical Access• Restricted Network Access• Secured Data AccessInfrastructure• Load balanced firewalls• Redundant HTTP Load Balancers• Isolated public/private LANs• Content Delivery network.• Standby Database/Application2.3 SECURITY MONITORING DESCRIPTIONFirewall• Real-time detection with IDS Identifies threats from unauthorized users, back-door attackers andhackers• Data collected through firewalls, detection sensors and VPN devices instantlyterminate any unauthorized sessions.• No Emails relaying• No long-timeout URLSystem logs• System logs on web services up to one week old.• Continuous error log parsing for immediate issue resolution.System 24/7 monitoring• Firewall Services• LAN Traffic• Load Balancer Services• Site Availability ServicesSecurity enforcement description• User Login• User Session Establishment• Use of 40, 56 or 1024 bits certificates (Optional)• Use of Authorized Trusted Mode Connection Gateway• Session Timeout for Inactive Users2.4 SYSTEM BACK UPBackup Data• Complete Customer data• Document Attachments (If applicable)• User Profiles (If applicable)• System Logs• Search AgentsBackup ExecutionBackups are performed in a hot backup mode (i.e. no interruption of Service), on a daily basis. Thedegradation of performances related to the backup process is negligible. Backups are incremental.Restoration is provided in case of a major damage on the production platform.Backup Tapes Retention DurationAll backups are run on a daily basis, including weekends. vFairs also performs a full backup of thesystem on a weekly basis.2.5 RECOVERY TIME ON MAJOR FAILUREvFairs will ensure that all the main components of the platform are redundant with active fail overcapacity. In the event of a major failure, the following recovery time are applied:SeverityWork begins withinResolution TimeCriticalWithin 30 Minutes3 hoursMajorWithin 1 Hour8 hoursMinorAs per priority of the clientAs per mutually agreed release scheduleExceptions in maintenance policy on ApplicationIn the event of a major technical issue or breakdown by the provider of 3rd party software orservices being used in the production platform of a given release, vFairs has the right not toprovide fixes on “Critical” severity incident, provided another release that includes the fix can bemade available to the customer.2.6 MAINTENANCE PATCHESMaintenance patches provides bug fixes, performance and SLA improvement through patchesAdditional features and change requests might also be added, based on market needs. Suchfeatures and change requests do not impact the current configuration of the customer, norrequire additional training.Release notes that describe the new features and changes requests, as well bugs being fixed arecommunicated to the system administrator after the patch is deployed.Patch CategoryThere are 2 categories of patches:• Normal patches include fixes on critical/major/minor severity bugs, as well as a combination ofchange requests and small features. These maintenance patches are deployed weekly during themaintenance window.• Emergency patches include fixes on issues that are qualified as urgent by vFairs, or related to highseverity bugs, security threats, performance, or availability. Emergency patches are deployed asrequired.Release ProcessMaintenance patches are deployed as required for all customers of a given release. Deployment occurspreferably in low system traffic time. The deployment is most of the time automatic. All existing setupand data will be kept as it.No user or administrator intervention. This does not require any manual intervention of customeradministrator.3. Data Ownership and AccessData OwnershipAll user data generated by the customer pursuant to the provision of services in the contract shall beowned exclusively by the customer.Data RetentionUser data will be held only as long as is necessary to implement, administer and manage thecustomer’s use of the vFairs platform. Once the contract between the two companies expires, all userand reporting data will be deleted from vFairs servers and backups.The customer can also submit a written request to delete this data at any time. Once the data isdeleted, vFairs can provide an official data destruction certificate upon request.Data accessThe customer will always have full access to user and reporting data. Access for vFairs team memberswill be granted as needed on the principle of least privilege.4. Customer Support4.1 SUPPORT DESCRIPTIONCustomer Support Services are delivered in English or languages may be available, based onthe language skills of the support team. Incidents may be reported to the vFairs Support Centerusing several possible methods like, email, Phone, Internet form.Support InfrastructurevFairs Customer Support Center operates on email-based trouble ticketing where all support ticketsare logged and dispatched. All reported incidents are classified for severity with 3 levels of incidentsseverity (minor, major, critical) triggering different internal resolution procedures and escalationroutes.vFairs support organization will come back to the customer within an agreed time frame, basedon the severity of the Incident. This contact will indicate the ticket #, the severity of the incident,as well as the expected time frame for providing a temporary fix/workaround, as well as apermanent resolution to the incident. There is an automatic notification of “high” severityincidents to vFairs Customer Administrator, System Administrator.Incident Resolution Follow UpEach incident resolution is communicated to the user who reported it as well as the CustomerAdministrator.4.2 PHONE HOURSvFairs offers several Hot-line availability options: Standard SupportPhone/EmailDaysMonday-FridayTime9:00 –18:00 (GMT +4) 24 x 7 SupportEmailDaysMonday-SundayTime0:00-0:00 (GMT +4)5. Incident Resolution5.1 SERVICE INCIDENTA Service Incident is defined as a malfunction of the vFairs BCCS which can be reproduced andwhose root cause is foundin the hosting service solution such as: hosting service internalnetwork, hosting service hardware or hosting service software components.Incident NotificationThe vFairs System Administrator is responsible for notifying all identified users/customers viavFairs Incident Status Page (https://status.vfairs.com/) of all incidents including PlannedDowntime, as well as any Unplanned Interruptions to system availability as they occur.All users / customers are responsible for checking and subscribing the vFairs Incident StatusPage for downtime and system status notifications.Problem Severity Classification 1 SeverityDescription Critical A Service Incident is classified as high if the service is not available (refer to service availability)MajorA problem is classified as major if a key feature or service is unavailablevFairs technical staff has the right to demote or promote the severity of any incident based on thenature of that incident.6. Operating Procedures6.1 DEPLOYMENT OF NEW SERVICESThe following section details the terms under which vFairs will open Maintenance Windows todeploy patches, releases and platform upgrades.Normal patch releaseDeployment window2 hoursDeployment scheduleUsually on weekendsInterruption of serviceUsually noneMaximum interruption of service2 hoursUpfront Notice Period Usually2 days Emergency patch releaseDeployment window2 hoursDeployment scheduleAs requiredInterruption of serviceUsually noneMaximum interruption of service8 hoursUpfront Notice PeriodAs required Feature releasesDeployment window8 to 48 hours Deployment scheduleWeekendsInterruption of serviceUsually YesMaximum interruption of service24 hoursUpfront Notice Period5 Days Platform UpgradesDeployment window8 to 48 hoursDeployment scheduleWeekends – Maximum twice a yearInterruption of serviceYesMaximum interruption of service36 hoursUpfront Notice Period2 weeksFor all service interventions, planned downtime within maintenance window is excluded from overall Uptime calculation.