Service Level Agreement (SLA)

Part I: General Provisions

Article 1: Purpose

This Service Level Agreement (hereinafter the "SLA") sets out the availability commitments, the measurement and reporting terms, the support commitments, the exclusions, the Service Credits, as well as the obligations relating to the security of the services and to the protection of personal data applicable to the services provided for consideration by Arkane Cloud (hereinafter "Arkane Cloud" or the "Provider") to the Customer.

This SLA supplements the General Terms of Service ("GTS"), the service-specific Specific Terms, the Acceptable Use Policy ("AUP") and the personal data processing agreement ("DPA") entered into between Arkane Cloud and the Customer.

Article 2: Contractual Documents and Order of Precedence

The Agreement consists of the following documents which, in the event of any conflict, prevail over one another in the following descending order of priority:

• the DPA, which prevails over any other document for any matter relating to the protection of personal data;
• the service-specific Specific Terms (appendices to the GTS);
• this SLA;
• the AUP;
• the Arkane Cloud GTS;
• the technical documentation of the services.

No general terms of purchase of the Customer shall apply to the Covered Services, unless expressly accepted in writing by Arkane Cloud.

The service level, support, security, continuity and reversibility commitments are enforceable against Arkane Cloud only to the extent that they are expressly provided for in this SLA.

The Documentation may specify the technical and operational terms of performance of the Services, but may not create any commitment, warranty, Service Credit, penalty or liability obligation that is not expressly provided for in this SLA or the GTS.

Article 3: Definitions

For the purposes of this SLA, the capitalized terms below have the following meaning. Terms defined in the DPA or in the general terms and conditions retain their meaning when used in this SLA.

"Customer": any legal entity acting for business purposes that has subscribed to a Covered Service from Arkane Cloud.

"Covered Service": a paid service expressly designated as covered by this SLA in the GTS or in the contractual documentation.

"GTS": the Arkane Cloud General Terms of Service, including their service-specific Specific Terms.

"AUP": the Acceptable Use Policy of the Arkane Cloud services, which forms an integral part of the Agreement.

"Monthly Availability": the availability percentage of a Covered Service calculated over a calendar month according to the method specific to that service, as defined in Articles 5 and 6 and in Appendix C.

"Unavailability": the state of a Covered Service meeting the technical criteria of non-availability defined in this SLA and in Appendix C, excluding the cases referred to in Article 13.

"Incident": any unplanned event causing an Unavailability or a significant degradation of a Covered Service.

"Security Incident": any confirmed or reasonably suspected event compromising or likely to compromise the confidentiality, integrity or availability of Arkane Cloud's systems or of the Customer's data hosted on the Covered Services.

"Personal Data Breach": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed, within the meaning of Article 4(12) of the GDPR.

"Service Credit": a credit note issued by Arkane Cloud in favor of the Customer as lump-sum compensation for an established failure to meet a Monthly Availability commitment.

"Planned Maintenance": a scheduled intervention by Arkane Cloud on its infrastructure or services, notified to the Customer under the conditions of Article 8.

"Emergency Maintenance": an unscheduled intervention made necessary by an imminent risk to the security, integrity or availability of the services.

"Availability Zone": a set of infrastructure physically and logically isolated from the other Availability Zones of the same region, in particular in terms of power supply, cooling and network.

"GTI (Guaranteed Intervention Time, or Garantie de Temps d'Intervention)": the maximum time between the reporting or detection of an Incident and its qualified acknowledgment by Arkane Cloud's teams.

"GTR (Guaranteed Restoration Time, or Garantie de Temps de Rétablissement)": the target time for restoring the Covered Service or for implementing a workaround.

"RTO (Recovery Time Objective)": the maximum targeted time for restoring a service after a major disaster.

"RPO (Recovery Point Objective)": the maximum acceptable data loss, expressed as a duration, in the event of a major disaster.

"Business Hours": from 9:00 a.m. to 6:00 p.m., Paris time, Monday to Friday, excluding French public holidays.

"Extended Business Hours": from 8:00 a.m. to 8:00 p.m., Paris time, Monday to Friday, excluding French public holidays.

"Reversibility": all of the operations enabling the Customer to recover all of its data and to migrate to another solution at the end of the Agreement, under the conditions of Article 21.

"GDPR": Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data.

"Documentation": all of the information and materials made available by Arkane Cloud describing the Services, their characteristics, prerequisites, limitations, terms of use, service levels, security measures, export formats and interfaces, as well as the versions, licenses and restrictions applicable to third-party models, software or components, within the meaning defined in Article 1 of the GTS.

"Usage Data": the technical, telemetry, performance, consumption, security and support data generated by the use of the Services, excluding Customer Content and Outputs, except where such data make it possible to identify or reconstruct them.

"Exportable Data" and "Digital Assets": the data, metadata, configurations, applications and other items that are portable or exportable under the conditions of the GTS, this SLA, the Documentation and the applicable mandatory provisions

"Valid Request": a request that technically complies with the formats, parameters, quotas, rate limits, identifiers and prerequisites indicated in the Documentation, excluding requests rejected due to a Customer error, a quota or rate overrun, incorrect authentication or prohibited content.

"Eligible Resource": a resource, instance, endpoint, volume, container or environment expressly designated as covered by this SLA and operated in a configuration compliant with the Agreement and the Documentation.

"Customer-Attributable Event": any event resulting from Customer Content, or from a configuration, administration, key, identifier, software, network, equipment or service placed under the control or responsibility of the Customer or of its own service providers.

Article 4: Scope

This SLA applies exclusively to Covered Services provided on a paid basis. It does not apply to free services, to services in beta, test or preview versions, to services provided free of charge or by means of promotional credits, or to consulting, integration or assistance services not expressly included in a service commitment.

Resources, software, applications, configurations, networks, equipment or third-party services that remain under the control of the Customer or of its own service providers do not fall within the scope of this SLA, in accordance with the shared responsibility model described in Article 19 and in Appendix B.

Part II: Service Level Commitments

Article 5: Availability Commitments

Arkane Cloud commits to the following Monthly Availability levels:

Article 6: Availability Measurement and Reporting

For compute services, a service is deemed unavailable when an instance, properly configured to allow the necessary communications, no longer has external connectivity on the expected network flows for a period exceeding one (1) minute. For object storage services, availability is calculated on the basis of the average server error rate (HTTP 5XX codes) on the relevant API requests, observed over five (5)-minute intervals during the calendar month concerned. The detailed operational definitions per service are set out in Appendix C.

Arkane Cloud makes available to the Customer:

• a public status page presenting, in real time, the status of the services and the incident history;
• a monthly availability report per Covered Service, provided on request or accessible from the Customer Console;
• for any P1-priority Incident, an incident report (post-mortem) provided within five (5) business days after resolution, describing the timeline, the root cause, the impact and the corrective measures.

Arkane Cloud's monitoring tools, logs, metrology data and technical records shall be authoritative for the calculation of availability, subject to a manifest error demonstrated by the Customer, who may produce its own measurement data for the purposes of an adversarial (contradictory) review.

Monthly Availability is calculated separately for each Covered Service, region, environment and service level expressly subscribed. Unavailability affecting several Services, resources or regions is neither aggregated nor counted more than once.

The calculation is performed over the calendar month during which the Covered Service was actually available. No Service Credit is due in respect of a period prior to the activation of the Service, a period after its termination, or a period during which no Eligible Resource and no Valid Request was used.

Measurements are made according to UTC time or, where so indicated in Appendix C, according to Paris time. The rounding, thresholds, measurement intervals and methods for handling incomplete periods are those provided for in Appendix C and may not give rise to the same unavailability being counted twice.

Article 7: Eligibility Conditions for the Multi-Zone Level

The enhanced availability level applicable to multi-zone deployments is only obtained if the Customer has actually deployed its resources across at least two distinct Availability Zones, with a redundancy configuration compliant with the Arkane Cloud documentation. Failing this, the service remains subject to the single-zone commitment level, even if the Customer operates several resources within the same zone.

Article 8: Maintenance

Planned Maintenance.

Arkane Cloud notifies the Customer of any Planned Maintenance likely to affect the availability of a Covered Service with a minimum prior notice of seven (7) calendar days, specifying the intervention window, the services concerned and the expected impact. Planned Maintenance is carried out, as a priority, within the lowest-impact window between 10:00 p.m. and 6:00 a.m., Paris time.

The cumulative unavailability attributable to Planned Maintenance may not exceed four (4) hours per calendar month and per Covered Service; beyond this cap, the excess minutes of unavailability are reintegrated into the calculation of Monthly Availability.

Emergency Maintenance.

In the event of an imminent risk to the security or integrity of the services (in particular a critical vulnerability patch), Arkane Cloud may carry out Emergency Maintenance without complying with the above prior notice. The Customer is informed thereof as soon as possible, and at the latest at the start of the intervention, unless this is technically impossible for justified reasons.

Emergency Maintenance may result in a temporary degradation or interruption of a Covered Service where such measure is necessary to prevent or limit a risk of security breach, compromise, loss of integrity or more extensive unavailability.

Article 9: Support and Incident Management

Arkane Cloud provides technical support allowing Incidents to be reported 24 hours a day, 7 days a week, via the Customer Console and via the channels indicated in the documentation. Incidents are qualified according to the following priority levels:

The GTI constitutes a contractual commitment. The GTR constitutes a target objective, except for P1 Incidents, for which repeated failure to meet the restoration time is taken into account under Article 12. Details of the escalation procedures are set out in Appendix A.

The GTI and GTR times are calculated from receipt of a complete report made through an authorized support channel and containing the information necessary to qualify the Incident. They are suspended during any period in which Arkane Cloud is awaiting from the Customer any information, action, access or cooperation necessary for diagnosis or restoration.

Article 10: Service Credits

Where the Monthly Availability of a Covered Service is lower than the applicable commitment, the Customer may claim a Service Credit calculated according to the schedule below, expressed as a percentage of the monthly amount invoiced for the affected Covered Service in respect of the month concerned:

The total cumulative amount of Service Credits granted for a given Covered Service over a calendar month may not exceed fifty percent (50%) of the monthly amount invoiced for said Covered Service in respect of the month concerned.

Service Credits are applied against the next invoice issued by Arkane Cloud. If the Agreement ends before the Service Credits have been fully applied, the balance of accrued Service Credits is refunded to the Customer within thirty (30) days following the effective date of the end of the Agreement.

Article 11: Claims Procedure

Any request for a Service Credit must be sent to Arkane Cloud within a maximum period of thirty (30) calendar days following the end of the month during which the Incident occurred. The request must include, at a minimum, the description of the Incident, the dates and times observed, the identifiers of the affected resources and any information reasonably useful for the examination of the claim.

Arkane Cloud examines the request in good faith and notifies the Customer of its reasoned decision within thirty (30) days following receipt of the complete claim. Failing a complete claim within the prescribed period, the Customer is deemed to have waived the benefit of the corresponding Service Credit.

Where the Unavailability has been detected and confirmed by Arkane Cloud's monitoring, the applicable Service Credit is offered to the Customer without the Customer having to provide any additional technical justification.

Article 12: Repeated Failures and Termination

Without prejudice to the Service Credits, the Customer may terminate as of right the Covered Service(s) concerned, without penalty or early termination fee, by written notice with thirty (30) days' prior notice, in any of the following cases:

• the Monthly Availability of the same Covered Service is lower than the applicable commitment for three (3) consecutive calendar months;
• the Monthly Availability of the same Covered Service is lower than the applicable commitment for four (4) months over a rolling twelve (12)-month period;
• the Monthly Availability of a Covered Service is lower than 95.00% in any given calendar month.

In the event of termination under this article, Arkane Cloud refunds to the Customer the amounts paid in advance in respect of the periods following the effective date of termination, and the Reversibility obligations of Article 21 apply in full.

Article 13: Exclusions

The following are excluded from the calculation of availability and from eligibility for Service Credits:

• Planned Maintenance notified in accordance with Article 8, within the limit of the monthly cap set out therein, as well as justified Emergency Maintenance;
• Unavailability resulting from non-compliant use, an administration error, an inappropriate configuration or failure by the Customer to comply with the Arkane Cloud documentation;
• incidents originating from third-party software, applications, equipment, networks or services not directly operated by Arkane Cloud or its subcontractors;
• incidents related to telecommunications operators, Internet access, routing or any event located beyond the network boundaries controlled by Arkane Cloud;
• distributed denial-of-service attacks of exceptional magnitude exceeding the state-of-the-art mitigation capabilities implemented by Arkane Cloud, as well as the exploitation of vulnerabilities falling within the Customer's scope of responsibility;
• cases of force majeure within the meaning of Article 1218 of the French Civil Code (Code civil);
• the suspension or restriction of the service implemented pursuant to the AUP or to the "Suspension of Services" article of the GTS, following a non-payment not remedied after formal notice or a serious contractual breach attributable to the Customer;
• for the Inference API service, rejections of requests for exceeding the applicable quotas or rate limits;
• losses of secrets, tokens, passwords, keys or identifiers resulting from mismanagement by the Customer;
• free offers, tests, betas, previews and services expressly excluded from the SLA.
• for the Serverless service, unavailability resulting from the Customer Model or its configuration by the Customer;
• for the Serverless service, the inability, where applicable, to start additional replicas due to a lack of available capacity.

Exclusions shall be strictly construed. The burden of proving that an Unavailability falls under an exclusion lies with Arkane Cloud.

Article 14: Remedies

Service Credits constitute the lump-sum and exclusive compensation for the loss resulting solely from failure to meet a Monthly Availability commitment. For the same event, the SLA compensation mechanisms are not cumulative; only the Service Credit most favorable to the Customer is applied.

This article does not preclude: (i) the right of termination provided for in Article 12; ii) the application of the liability, exclusion and cap provisions set out in the GTS and the DPA; and (iii) the mandatory rules applicable to gross negligence or willful misconduct, personal injury, or any other case in which a limitation of liability is prohibited.

Part III: Security of the Services

Article 15: Security Governance and Frameworks

Arkane Cloud maintains an information security organization with a documented security policy, reviewed at least annually, and an identified information systems security officer (responsable de la sécurité des systèmes d'information). Arkane Cloud's security management system is aligned with the ISO/IEC 27001 standard and with the IT hygiene guide of ANSSI (the French National Cybersecurity Agency).

Arkane Cloud has undertaken in its own right, as a priority, a certification process for ISO/IEC 27001 (information security management), ISO/IEC 27701 (privacy information management) and ISO/IEC 42001 (artificial intelligence management). Arkane Cloud keeps the Customer informed of the progress of these processes and provides the certificates to the Customer as soon as they are obtained.

Upon reasonable request by the Customer and subject to a confidentiality agreement, Arkane Cloud provides a summary of its security policies, its current attestations and certificates, as well as answers to the Customer's standard security questionnaires.

Article 16: Technical and Organizational Security Measures

Arkane Cloud implements and maintains, in accordance with the state of the art, at a minimum the following measures:

• Encryption in transit: all administration interfaces and APIs exposed by Arkane Cloud are protected by TLS 1.2 at a minimum;
• Encryption at rest: the storage media of the shared platforms are encrypted at rest (AES-256 or equivalent); the Customer retains the ability to encrypt its data with its own keys;
• Isolation: strict logical isolation between customers on the shared platforms;
• Logging: logging of administrative access and of relevant security events, with retention of logs for a minimum of twelve (12) months where such logs are necessary for security, detection or incident analysis, and protection against tampering.
• Detection and response: security monitoring of the infrastructure and a documented process for the detection, qualification of and response to Security Incidents;
• Physical security: physical access control to the data centers, power and cooling redundancy, compliant with current professional standards;
• Personnel: confidentiality undertakings and security awareness training for all personnel authorized to access production environments;
• Operations: configuration hardening, separation of production and development environments, and a documented change management process.

The security measures described in this article constitute best-efforts measures (mesures de moyens) appropriate to the scope, architecture and risks of the Covered Services. They do not constitute a guarantee of the absence of any vulnerability, attack, incident or unauthorized access.

The measures may be modified, replaced or strengthened by Arkane Cloud where necessary for security, maintenance, the evolution of the architecture or compliance with applicable law, provided that the level of security contractually applicable to the Service concerned is not substantially degraded.

Article 17: Business Continuity and Disaster Recovery (BCP / DRP)

17.1 Arkane Cloud maintains a business continuity and disaster recovery plan covering major disaster scenarios affecting its infrastructure, tested at least once a year. The recovery objectives applicable to the Covered Services are as follows: Arkane Cloud maintains a documented business continuity plan (BCP) and disaster recovery plan (DRP).

The BCP aims to maintain the Services in the event of a component failure, by means of redundancy mechanisms. Its effects on availability fall under the SLA.

The DRP aims at the recovery of the Services after a Major Disaster. A Major Disaster is any event rendering all or part of a hosting site unavailable for a foreseeable duration exceeding [24] hours. This includes, in particular, a fire, a flood, a prolonged loss of power supply or connectivity, the destruction of equipment or a large-scale cyberattack.

17.2 The recovery objectives are set out in the table below.

The RTO means the maximum targeted time between the declaration of the Major Disaster by Arkane Cloud and the Service concerned being made available again.

The RPO means the maximum period of data that may be lost, counted backwards from the occurrence of the Major Disaster.

17.3 The recovery objectives constitute a best-efforts obligation (obligation de moyens). Failure to meet them does not give rise to service credits.

With respect to the Compute Services, the Customer remains solely responsible for backing up its data, systems and software. Arkane Cloud does not restore the content of Instances.

The recovery of Services requiring GPU resources is subject to the availability of substitute capacity.

Customer Models are redeployed from the source designated by the Customer.

A certificate of completion of the annual DRP test is provided to the Customer on request.

Article 18: Notification of Security Incidents

Arkane Cloud notifies the Customer of any Security Incident affecting or likely to affect the Customer's Covered Services or its data, in accordance with the following terms:

• initial information as soon as possible and at the latest twenty-four (24) hours after the qualification of the Security Incident, describing the nature of the event, the known affected scope and the first measures taken;
• a detailed report at the latest seventy-two (72) hours after qualification, supplemented as the investigations progress;
• a final report after resolution, describing the root cause, the impact, the corrective measures and the preventive measures adopted.

The notification obligations provided for in this article concern Security Incidents that Arkane Cloud reasonably considers likely to significantly affect a Covered Service, Customer Content or the personal data processed on behalf of the Customer. They do not apply to events detected and contained within internal systems, to unsuccessful attempts or to events presenting no reasonable risk of impact on the Customer.

Arkane Cloud may defer, limit or anonymize the information communicated where its disclosure is likely to compromise the security of the Services, reveal information concerning other customers, prejudice an investigation or breach a legal or contractual confidentiality obligation.

These commitments apply without prejudice to the obligations specific to Personal Data Breaches provided for in Article 10 of the DPA, and are defined consistently with the notification requirements of Directive (EU) 2022/2555 ("NIS 2") and its transposition into French law. Notification does not, in itself, constitute an admission of liability.

Arkane Cloud security point of contact: [email protected]

Article 19: Shared Responsibility Model

The security of cloud services follows a shared responsibility approach: Arkane Cloud is responsible for the security of the infrastructure and of the managed services that it operates ("security of the cloud"); the Customer is responsible for the security of what it deploys and configures on these services ("security in the cloud"), in particular guest operating systems, applications, identities and secrets, the network and security configurations that it administers, as well as the compliance of its processing. The detailed matrix allocating responsibilities is set out in Appendix B and forms an integral part of this SLA.

Part IV: Personal Data Protection

Where Arkane Cloud processes personal data on behalf of the Customer in connection with the Covered Services, the Parties apply the personal data processing agreement ("the DPA"). The DPA constitutes a standalone appendix compliant with Article 28 of the GDPR.

Part V: Miscellaneous Provisions

Article 20: Audit

Arkane Cloud makes available to the Customer all information necessary to demonstrate compliance with its obligations under this SLA and the DPA, in particular its certifications, attestations, third-party audit reports and penetration test summaries.

The Customer (or an independent third-party auditor appointed by it, who is not a competitor of Arkane Cloud and is bound by a confidentiality agreement) may in addition carry out an audit, including an on-site inspection, no more than one (1) time per twelve (12)-month period, subject to thirty (30) days' prior written notice and a scope jointly agreed in advance. The audit is conducted during Business Hours, so as not to disrupt the services or compromise the security or confidentiality of other customers. Each party bears its own audit costs.

In the event of a major Security Incident affecting the Customer or of a proven breach, an additional audit may be carried out without waiting for the expiry of the twelve (12)-month period. Arkane Cloud uses reasonable means to enable these rights to be exercised with respect to its subcontractors, subject to the confidentiality and security constraints applicable to their environments.

Arkane Cloud remedies, within a reasonable period agreed with the Customer, any material non-conformities identified during an audit.

The right of audit is exercised primarily by means of the information, attestations, certifications, independent reports, security questionnaires and test summaries already available. It may not have the effect of requiring Arkane Cloud to disclose trade secrets, details making it possible to circumvent its security measures, data concerning other customers or unredacted audit reports.

The Customer and its auditor may not carry out any penetration test, vulnerability scan, load test or other intrusive operation on the infrastructure, networks or Services operated by Arkane Cloud without its prior written consent.

Article 21: Reversibility and Portability

During the term of the Agreement, the Customer may export its Exportable Data and its Digital Assets by means of the interfaces, formats and procedures made available for the Service concerned, in particular those described in Appendix D or in the Documentation.

Items belonging to Arkane Cloud or to third parties, or protected by intellectual property rights, trade secrets or confidentiality obligations, are not included in the scope of the export, unless otherwise provided by an applicable provision.

At the end of the Agreement or of the Service concerned, or in the event of a request to switch provider or to port a Service to an infrastructure of the Customer or of another provider, Arkane Cloud implements the return, portability and reversibility measures applicable to the Service concerned.

These measures do not affect the other Services subscribed by the Customer.

Data, configurations, backups or components common to several Services may be retained to the extent necessary for the provision, security or continuity of the Services that are maintained.

Arkane Cloud provides reasonable assistance with switching or migration, within the limits of the Service's functionalities and of the information available.

This assistance is invoiced at the rate communicated to the Customer before it begins, unless it is required to be provided free of charge by an applicable mandatory provision.

During the transition and retrieval period applicable to the Service concerned, Arkane Cloud maintains, within the limits necessary for the security and proper functioning of the Services, the Customer's read and export access to its Exportable Data and its Digital Assets. In the absence of a different mandatory duration, this period is set at thirty (30) calendar days and may be extended by sixty (60) days upon the Customer's written request.

The ordinary fees for the Service, the consumption and the resources maintained at the Customer's request during the transition or retrieval remain payable.

Any switching or data transfer charges may only be invoiced within the limits authorized by the applicable mandatory provisions, in particular those relating to their capping or their abolition as from January 12, 2027.

At the end of the retrieval period, Arkane Cloud deletes the Exportable Data and Digital Assets concerned from its production systems, then from backups according to the applicable rotation cycles, unless there is a legal retention obligation or a need to maintain another Service.

A certificate of deletion is provided to the Customer on request.

Arkane Cloud does not retain or block the Customer's Exportable Data or Digital Assets solely on the grounds of a dispute relating to amounts due, without prejudice to its right to recover the amounts payable and to suspend or restrict the Services under the conditions provided for in the Agreement.

Article 22: Insurance

Arkane Cloud takes out and maintains for the entire term of the Agreement, with insurance companies of recognized solvency, professional civil liability insurance and insurance covering cyber risks, for coverage amounts appropriate to the nature of the services provided.

Insurance certificates are provided to the Customer on request, upon signature and then upon each annual renewal.

Article 23: Confidentiality

Each party undertakes to preserve the confidentiality of information of any kind, identified as confidential or whose confidential nature results from the circumstances, received from the other party in connection with the Agreement, for its entire term and for five (5) years after its expiry. The Customer's data, its configurations, its usage volumes and the incident reports concerning it are confidential information of the Customer. Arkane Cloud's detailed security policies, audit reports and penetration test reports are confidential information of Arkane Cloud.

Article 24: Evidence and Traceability

Arkane Cloud's technical records, logs, timestamps and monitoring data may be used as evidence to assess an Incident, subject to a demonstrated manifest error. The Customer may produce its own measurement data for the purposes of an adversarial (contradictory) review. The parties cooperate in good faith to qualify the scope, cause and consequences of any event affecting availability or security.

Article 25: Changes to the SLA

Arkane Cloud may amend this SLA, the measurement methods, the operational procedures and the applicable technical measures in order to take into account technical, security or regulatory developments, constraints affecting the third-party components or suppliers necessary for the provision of the Services, or changes to its service offering. Any amendment is notified to the Customer in writing, indicating its effective date.

Amendments that do not substantially impair the commitments expressly subscribed for a Covered Service, in particular those relating to the Documentation or operational procedures, to support channels or to measurement methods where they do not have the effect of reducing the applicable service level, may take effect on the date indicated in the documentation.

An amendment may not have the effect of substantially degrading the commitments expressly subscribed for a Covered Service during a firm commitment period, except where such amendment is necessary to comply with a legal or regulatory obligation, to prevent or address a security risk, to remedy a vulnerability, or to take into account the withdrawal, modification or unavailability of a third-party component or supplier necessary for the provision of the Service, where maintaining the commitments concerned becomes impossible, unlawful or unreasonably burdensome for Arkane Cloud.

In the cases mentioned in the preceding paragraph, Arkane Cloud implements, to the extent reasonably possible, an alternative solution or a measure mitigating the consequences of the amendment and informs the Customer thereof as soon as possible.

In the event of an unfavorable amendment resulting in a substantial degradation of the commitments applicable to a Covered Service, the Customer has a period of thirty (30) days from notification to terminate the Covered Services concerned without penalty in accordance with Article 21 of the GTS. Failing termination within this period, the amendment is deemed accepted on its effective date.

Article 26: Governing Law and Jurisdiction

This SLA is governed by French law. Any dispute relating to its validity, interpretation or performance shall be the subject of an attempt at amicable resolution between the senior management of the parties for thirty (30) days before any referral to a court, except in an emergency justifying a protective measure.

Any dispute relating to this SLA falls within the exclusive jurisdiction of the Commercial Court of Lyon (Tribunal de commerce de Lyon), notwithstanding multiple defendants or third-party claims (appel en garantie), including for emergency and protective proceedings.

Appendix A: Severities, Escalation and Support Contacts

Incident reporting channels: Customer Console (https://console.arkanecloud.com/support, 24/7), support e-mail ([email protected]) and, for P1 Incidents, an on-call telephone line.

Escalation: if the Incident is not acknowledged within the applicable GTI or in the event of disagreement on the qualification, the Customer may escalate successively:

Appendix B: Shared Responsibility Matrix

Appendix C: Operational Definitions of Indicators per Service

• Compute Instance: an instance is unavailable when it no longer has any external network connectivity on the expected flows for more than one consecutive minute, excluding a shutdown triggered by the Customer. Minutes of unavailability are aggregated per instance and per calendar month.
• Managed Load Balancer: unavailable when all of the healthy target instances no longer receive the distributed traffic, measured by monitoring probes at one-minute intervals.
• Object Storage: error rate = (requests in 5XX error) / (total valid requests received) per 5-minute interval; monthly availability = 100% minus the average of the error rates of the intervals in the month. Intervals with no traffic are deemed 100% available.
• Managed Kubernetes: availability of the control plane API measured by probes at one-minute intervals; worker nodes fall under the Compute Instance SLA.
• Inference API: error rate = (5XX responses) / (total valid requests received, excluding requests rejected for exceeding quota or rate limits, i.e. 429 and similar codes) per 5-minute interval; monthly availability = 100% minus the average of the error rates of the intervals in the month. Intervals with no traffic are deemed 100% available.
• Serverless: the error rate is calculated using the same method as for the Inference API, i.e. the number of 5XX responses relative to the total number of valid requests received, excluding requests rejected for exceeding quota or rate limits, per five (5)-minute interval. 5XX responses resulting from the unavailability of the underlying resource, in particular GPUs, are taken into account. Monthly availability is equal to 100% minus the average of the error rates of the intervals in the month. Intervals with no traffic are deemed 100% available.

Appendix D: Reversibility Terms

• export formats: S3-compatible API (object storage), disk images in standard formats (qcow2 / raw), configuration exports (YAML/JSON) for Kubernetes;
• Reversibility period: 30 calendar days from the end of the Agreement, extendable by 60 days upon written request;
• migration assistance: on quotation, at the current time-and-materials rate, subject to the charges or free-of-charge requirements imposed by the mandatory provisions applicable to switching providers;
• secure and irreversible deletion at the end of the period, backups included within the timeframes of the rotation cycles;
• certificate of deletion provided on request within thirty (30) days following deletion.

Executed in two original counterparts,