SLA
This Service Level Agreement sets out the support, availability and maintenance commitments applicable to the Canvas platform.
This SLA forms part of, and is incorporated into, the applicable Canvas Terms and Conditions agreed between Watermelon Research (or its relevant regional contracting entity) and the Client.
1. Scope of Service
Canvas is delivered as a Software-as-a-Service (SaaS) platform and includes:
Secure hosting of the Canvas application
Platform maintenance and technical management
System updates and enhancements
Security monitoring and management
Application support services
Canvas is hosted within secure Microsoft Azure data centres in the applicable regional location(s) agreed with the Client.
2. Service Availability
Watermelon targets 99.5% uptime per calendar month, excluding:
Scheduled maintenance
Emergency maintenance
Force majeure events
Failures attributable to third-party infrastructure providers
Issues caused by Client systems, integrations, or internet connectivity
Availability is measured at the application level.
Watermelon reserves the right to perform maintenance necessary to ensure the continued security, stability and performance of the platform.
3. Support Services
3.1 Support Hours
Support is provided Monday to Friday, 9:00am – 6:00pm (local time of the contracting Watermelon entity), excluding public holidays, unless otherwise agreed in writing.
3.2 Response Targets
ISSUE SEVERITY INITIAL RESPONSE TARGET TARGET RESOLUTION TIME
Critical 2 business hours 8 business hours
High 4 business hours 24 business hours
Medium 8 business hours 3 business days
Low 1 business day. 7 business days
4. Maintenance
Routine maintenance will, where reasonably practicable, be scheduled outside standard business hours and communicated in advance.
Emergency maintenance may be carried out without prior notice where necessary to protect platform security or integrity.
5. Security Commitments
Watermelon maintains an Information Security Management System certified to ISO 27001:2022.
Watermelon implements appropriate technical and organisational measures to protect Client data, including:
Encryption of data in transit and at rest
Role-based access controls and least privilege principles
Regular vulnerability scanning
Independent penetration testing
Security monitoring and incident management procedures
Security incident notification obligations are governed by the applicable Data Processing Agreement and relevant data protection legislation.
6. Data Protection Roles
Where Canvas processes personal data on behalf of the Client, the parties acknowledge that:
The Client acts as Data Controller (or equivalent role under applicable legislation).
Watermelon acts as Data Processor (or equivalent role under applicable legislation).
Watermelon processes personal data solely for the purpose of providing and supporting the Canvas platform and in accordance with the applicable Data Processing Agreement.
In self-service deployments, the Client is responsible for determining the purposes and means of processing personal data within Canvas. Watermelon does not access, use or analyse Client data except where necessary to provide support, maintain system integrity, or as required by law.
Where Watermelon provides additional managed services (including survey design, configuration or administration), processing activities shall remain subject to the applicable Data Processing Agreement.
Each party shall comply with applicable data protection and privacy legislation, including (where applicable):
UK GDPR and the Data Protection Act 2018
EU GDPR
The Australian Privacy Act 1988 (Cth)
7. Limitations
This SLA does not apply to:
Beta features or trial services (unless expressly agreed)
Issues arising from unsupported browsers or legacy systems
Performance limitations caused by Client hardware, device capability, or internet connection
Watermelon may update this SLA from time to time. The current version will be published on the Canvas website and shall apply from the date of publication.