Arbor Cloud Supplemental Terms and Conditions

These Arbor Cloud Supplemental Terms and Conditions (“Supplemental Terms”) supplement the terms of the License and Cloud Service Agreement (the “Agreement”) and are incorporated therein. Together, the Agreement and these Supplemental Terms govern Your (the “End User”) use of the Arbor Cloud Services. Capitalized terms not otherwise defined in these Supplemental Terms shall have the meaning ascribed to them in the Agreement.

1. SERVICE DEFINITIONS
The following definitions shall apply to the capitalized terms used herein.
1.1 “/24 Prefix” means a block of two hundred fifty four (254) continuous IP addresses.

1.2 “Arbor Cloud Platform” means the network to which internet-based traffic for an Endpoint must be directed in order to have the Arbor Cloud Services performed.

1.3 “Arbor Cloud Services” means the on-demand, End User-activated, cloud-based, service which “cleans” or “scrubs” certain internet-based, malicious, attack traffic from a stream of internet based traffic directed at the End User’s Endpoint and, where applicable, any supplemental services set forth on the order Form.
1.4 “Attack” or “Attack Incident” shall mean an event in which malicious traffic (e.g. DDoS), is directed at an Endpoint which is on the Arbor Cloud Platform. The determination as to whether traffic is Attack traffic shall be determined solely by Arbor.
1.5 “Attack Incident Fee” shall mean the fee applicable to use of the Arbor Cloud Service during an Attack.
1.6 “Clean Traffic” shall mean the 95th percentile peak Mbps of legitimate End User internet traffic going in to or out of the Arbor Cloud Platform for an Endpoint, which is processed by the Arbor Cloud Service on a per Mitigation Incident basis.
1.7 “Clean Traffic Overage Fee” means the fee, calculated on a per megabits per second (“Mbps”) basis, that will apply in the event that amount of Clean Traffic to the Arbor Cloud Platform during a Mitigation Incident exceeds the amount of traffic contracted for.
1.8 “Content” shall be as defined in Section 6.2.
1.9 “Endpoint(s)”, as used herein, means that part of an End User’s infrastructure subject to protection by the Arbor Cloud Services and for which End User or Arbor has activated the Arbor Cloud Services by directing traffic to the Endpoint onto the Arbor Cloud Platform.
1.10 “Incident” means an event wherein End User has directed internet-based traffic for an Endpoint to the Arbor Cloud Platform and shall include both Attack Incidents and Non-Attack Incidents.
1.11 “Location” means router endpoint to terminate GRE (Generic Routing Encapsulation) tunnels connected to the Arbor Cloud Platform.
1.12 “Mitigation Incident” means either (a) the event commencing when Arbor announces the requested /24 prefix(es) out of the Arbor Cloud Platform and ceases when End User contacts Arbor pursuant to then-current Arbor policies and directs Arbor to cease such announcement(s) or (b) an event where more than twenty-five (25) kilobits per second (“Kbps”) of traffic flows through the End User’s assigned DNS Redirection VIP address on the Arbor Cloud Platform.
1.13 “Mitigation Incident Fee” shall mean the fee that applies to a Mitigation Incident. The Mitigation Incident Fee shall cover a period of up to seventy two (72) consecutive hours or any portion thereof. Mitigation Incidents longer in duration than seventy two (72) consecutive hours are subject to Mitigation Incident Fees for each period of consecutive seventy two (72) hours or any part thereof.
1.14 “Non-Mitigation Incident” shall mean a Migration Incident in which the Partner or End User Customer has directed internet-based traffic for an Endpoint to the Arbor Cloud Platform and there has been no Attack traffic for a period of seventy two (72) consecutive hours.
1.15 “Non-Mitigation Incident Fee” means the fee applicable to use of the Service during a Non-Mitigation Incident and shall apply every seventy two (72) hours or portion thereof wherein Partner or End User Customer directs internet-based traffic for an Endpoint to the Arbor Cloud Platform.
1.16 “Service Package Fee” means the annual (unless otherwise specified on the Form) recurring charge that End User pays for access to the Arbor Cloud Service.
1.17 “Provisioning Process” means Arbor’s then-current process for provisioning of an Endpoint, a change to configuration or directing End User traffic to or away from the Arbor Cloud Platform.
1.18 “VIP(s)” or “DNS Redirection VIP(s)” means the Arbor-assigned IP address on the Arbor Cloud Platform which terminates to only one (1) End User hosted IP address to send Clean Traffic & receive outbound internet traffic.

2. PROVISION OF ARBOR CLOUD SERVICES
2.1 End User acknowledges that deployment on the Arbor Cloud Platform may require configuration which takes several days and that in such instance, any activation of Arbor Cloud Services on an expedited basis shall require deployment on the DNS-based platform rather than the BGP-based platform as Arbor, in its reasonable discretion, determines is appropriate.
2.2 Arbor shall calculate the End User’s total amount of used Clean Traffic in Mbps, at the ninety fifth (95th) percentile during each Mitigation Incident to confirm they are within their total contracted Clean Traffic amount. Clean Traffic shall be determined by periodically measuring End User’s Clean Traffic bandwidth utilization running through the Arbor Cloud Platform. At the end of a measurement period (Mitigation Incident), the utilization measurements are ordered from highest to lowest and the top five percent (5%) of the traffic measurements discarded. The next highest measurement for the inbound or outbound traffic is considered the ninety fifth (95th) percentile Clean Traffic.
2.3 In the event of a Mitigation Incident, any traffic which is directed to the Arbor Cloud Platform that is not for a pre-provisioned domain, protocol or port will be blocked. Attack traffic may be mitigated as far “upstream” as possible, including internet network provider access control lists (ACLs). In such event, the End User will not be assessed any Clean Traffic Overage Fees related to the volume of the attack traffic. Clean Traffic Overage Fees shall only be incurred when the actual quantity of Clean Traffic measured during a Mitigation Incident exceeds the amount of Clean Traffic contracted for.
2.4 The Arbor Cloud Service may be provisioned to protect up to ten (10) ports per domain for standard TCP based application layer protocols, including: Web (e.g. HTTP, HTTPS), API (e.g. SOAP, XML, REST), Email (e.g. POP/POP3, SMTP, IMAP/IMAP4), Database (e.g. MySQL, MS SQL, Oracle) & Other (e.g. Telnet, SSH, FTP).
2.5 The Arbor Cloud Service includes Layer 4 rate limiting protection for HTTPS traffic provisioned on the Arbor Cloud Platform. The Arbor Cloud Service does not open HTTPS packets for “inspection”, “cleaning” or “scrubbing” unless the End User has elected to utilize a packet inspection service, if offered, at the application Layer 7 level on a per domain, per SSL certificate basis. This packet inspection service requires End User to provide Arbor with valid SSL certificates to be loaded on to the Arbor Cloud Platform for the traffic that shall be subject to HTTPS packet inspection.
2.6 Support services for the Arbor Cloud Service are provided in English only.

3. END USER OBLIGATIONS
3.1 End User acknowledges that Arbor Cloud Services may only be used for internal purposes only unless otherwise mutually agreed upon with Arbor and indicated on the applicable order Form.
3.2 End User shall provide all information requested by and pursuant to the Provisioning Process for each Endpoint prior to activation of the Arbor Cloud Services with respect to that Endpoint and shall inform Arbor of any changes to such information for the duration of the Arbor Cloud Services.
3.3 For BGP-based services, End User must provide BGP and GRE capable device(s) and properly configure such device(s).
3.4 End User shall provide Arbor with: (i) information on the Endpoints as requested by Arbor and such other information that Arbor requires in order to provide the Arbor Cloud Services; and (ii) access to the Endpoints in order to perform the Arbor Cloud Services.
3.5 End User acknowledges that in order for Arbor to provide the Arbor Cloud Services, End User must first redirect the internet traffic for the Endpoint to the Arbor Cloud Platform.
3.6 End User acknowledges that operation and performance of the Arbor Cloud Services involves repeated filtering of traffic to the Endpoint and End User expressly consents to the same. End User hereby grants Arbor, for the Term, a non-exclusive, non-transferable, and royalty-free license to access the Endpoint and the internet traffic flowing thereto and any applications contained therein.
3.7 End User shall be solely responsible for the direction of all internet traffic for an Endpoint by following Arbor’s procedures then in effect under the Provisioning Process (which may include, by way of example, contacting support and having Arbor announce or cease announcing the requested /24 prefixes or changing DNS to DNS Redirection VIPs).
3.8 End User shall have a technical contact available during the entirety of a Mitigation Incident that speaks English to enable End User to interact with Arbor’s support team.
3.9 During a Mitigation Incident, End User shall:
3.9.1 route all traffic for an Endpoint to Arbor
3.9.2 ensure rate limiting is turned off
3.9.3 set DNS TTL (Time to Live) at 300s for all protected infrastructure
3.9.4 set ACLs to drop all traffic not originating from Arbor
3.9.5 whitelist Arbor IP addresses
3.9.6 ensure other mitigation equipment is disabled within End User environment.
3.10 End User shall have documented internal emergency/incident response procedures for DDoS attacks.
3.11 End User acknowledges that the Arbor Cloud Service is an on-demand service for use during Attack Incidents only and is not meant to be used as an always-on service during periods when an Attack is not occurring. Use of the service when an Attack is not occurring for a period of 72 consecutive hours is considered a Non-Mitigation Incident and will be assessed a Non-Mitigation Incident Fee.
3.12 End User shall take all such action as is reasonably necessary to enable Arbor to perform the Arbor Cloud Services.
3.13 Acceptable Use Policy (“AUP”). End User shall not use, or allow use of, the Arbor Cloud Service in any of the following manners (“Abuses”): (a) Use of the Arbor Cloud Service in an unlawful manner or for an unlawful purpose, (b) Use of the Arbor Cloud Service in a manner that, in Arbor’s reasonable discretion, directly or indirectly produces or threatens to produce a negative effect on the Arbor Cloud Service network other than in a manner for which the Arbor Cloud Service network was designed or that interferes with the use of the Arbor Cloud Service network by other customers or authorized end users, including, without limitation, overloading servers or causing portions of the Arbor Cloud Service network to be blocked; or (c) excessive or prolonged use of the Arbor Cloud Service while not actively mitigating a DDoS attack or incident.
3.14 Arbor may suspend an Endpoint or the Arbor Cloud Services, as applicable, if, in Arbor’s reasonable determination, an Abuse occurs. Such suspension shall remain in effect until End User corrects the applicable Abuse. In the event that, in Arbor’s reasonable determination, an Abuse is critically impacting, or threatens to impact critically, the Arbor Cloud Service network or servers, Arbor may suspend an Endpoint or the Arbor Cloud Service, as applicable, immediately and without prior notice. In the event that an Abuse is not critically impacting the Arbor Cloud Service network or threatening to do so, Arbor shall give prior notice of any suspension. End User’s failure to correct any Abuse within thirty (30) days after receipt of notice will entitle Arbor to terminate Arbor Cloud Services as provided for in the Agreement.
3.15 Discontinuation of the Arbor Cloud Services. Arbor may discontinue the Arbor Cloud Service at any time upon seventy-five (75) days prior written notice provided that such right shall not be utilized by Arbor as a termination for convenience, but shall only be used where such discontinuance would apply to all or substantially all of Arbor’s customers.
3.16 Only End User is authorized to provide Content to Arbor for provision of the Arbor Cloud Services and End User is responsible for such Content (whether such Content actually belongs to End User or to End User’s customers). End User will be deemed to have taken any action that End User permits, assists or facilitates any person or entity to take related to the Agreement and Supplemental Terms, the Content or use of the Arbor Cloud Services.

4. TERM AND TERMINATION
The Arbor Cloud Service shall commence on Arbor’s receipt of a purchase order from End User (or, where applicable, from an authorized Arbor reseller on End User’s behalf) and shall continue in effect for the term set forth on the Form (“Initial Term”). Upon expiration of the Initial Term, the Arbor Cloud Service will be renewed automatically for successive twelve (12) month periods (“Renewal Term(s)”) unless either party gives written notice of its intent not to renew the Arbor Cloud Service at least thirty (30) days prior to the end of the Initial Term or the then-current Renewal Term (the Initial Term and any Renewal Terms, collectively the “Term”). End User shall give any notice of non-renewal by sending an e-mail to orders (at) arbor (dot) net.

5. PAYMENTS AND FEES.
5.1 End User shall pay Arbor the service fees set in the Form (“Service Fee”). The Service Package Fee shall be invoiced on an annual recurring basis unless otherwise specified on the Form commencing upon Arbor’s receipt of a purchase order from End User (or, where applicable, from an authorized Arbor reseller on End User’s behalf). Mitigation Incident Fees, Non-Mitigation Incident Fees, Clean Traffic Overage Fees, Standard Setup Fees, Emergency Setup Fees, Standard Change Fees and Emergency Change Fees shall be charged when and if incurred.
5.2 The Service Package Fee includes the domains, Locations and /24 prefixes indicated on the Form. Additional domains, Locations and /24 prefixes may be added to the package for an additional fee.
5.3 The “Emergency Setup Fee” shall be incurred in the event that, in response to an End User request, provisioning of the Arbor Cloud Service is performed within four (4) hours of Arbor’s approval of End User’s request. The Emergency Setup Fee shall apply in addition to any related Service Package Fees, Mitigation Incident Fees and, if applicable, any Clean Traffic Overage Fees.
5.4 The “Emergency Change Fee” shall be charged for End User initiated additions, deletions and updates related to domain names, IP addresses, Locations, ports & protocols performed within four (4) hours of Arbor’s approval of End User’s request and via the Provisioning Process.
5.5 End User will be charged Clean Traffic Overage Fees if, during a Mitigation Incident or a Non-Mitigation Incident, Arbor determines that the 95th percentile peak clean traffic flowing through the Arbor Cloud Platform exceeds the contracted Clean Traffic amount. End User will be charged a per Mbps overage fee for the additional, peak Clean Traffic.
5.6 Depending on the Arbor Cloud Services model you have purchased, if You exceed Your allotted mitigations or capacity, Arbor shall invoice You for the applicable amount and Your payment will be due pursuant to the payment terms specified on the Form.
5.7 Pricing for any Renewal Term is subject to change, provided Arbor notifies End User of any such price change at least forty-five (45) days before the commencement of the Renewal Term.

6. WARRANTIES
6.1 Arbor represents that the Arbor Cloud Services will perform as described in the service level agreement attached hereto at Exhibit A (“SLA”). End User’s sole and exclusive remedy, and Arbor’s sole and exclusive obligation, for a breach of the foregoing representation will be the remedy(ies) set forth in the SLA. A breach of this representation or the SLA shall not constitute a breach of Your Agreement.
6.2 End User represents and warrants that End User: (a) has all right, title and interest or is the licensee with right to use and/or access all of the Endpoints, applications and/or content provided to perform the Arbor Cloud Services and all of the content accessed at End User’s direction to perform the Arbor Cloud Services (together, “Content”); (b) If the End User utilizes a packet inspection service, that its provision of the SSL certificate for the HTTPS Packet Inspection service and Arbor’s use thereof for provision of the Arbor Cloud Service does not violate any laws, security policies or regulations or infringe the proprietary or privacy rights of any third party; (c) shall not use the Arbor Cloud Services for any unlawful purpose; and (d) shall comply with these terms as may be updated by Arbor in writing from time to time. End User further represents that neither the U.S. Bureau of Industry and Security nor any other governmental agency has issued sanctions against End User or otherwise suspended, revoked or denied End User’s export privileges.

7. INDEMNITY
7.1 End User will defend at its own expense any action brought against Arbor, its directors, officers, or employees by a third party to the extent that the action is based on a claim, suit, or proceeding arising from or relating to (i) the breach of any representation or warranty set forth herein; (ii) any third party claim that Arbor’s provision of the Arbor Cloud Service to Endpoints designated by End User in connection with performing the Arbor Cloud Services for End User is not authorized; or (iii) End User-provided Content, including without limitation, any claim involving alleged infringement or misappropriation of any patent, copyright, trademark, trade secret or other third-party intellectual property rights by such Content. This Section 7 shall survive termination of the Agreement.

8. EXPORT REGULATION
In addition to the export controls provisions contained in the Agreement, End User will not use the Arbor Cloud Service to export or re-export any technical data or software to the list of terrorist supporting countries or to any person or entity on the U.S. Department of Commerce Denied Persons List or on the U.S. Department of Treasury's lists of Specially Designated Nationals, Specially Designated Narcotics Traffickers or Specially Designated Terrorists (together, “Denied Parties”). Access to the Arbor Cloud Service: a) from the list of terrorist supporting countries, or b) by Denied Parties is strictly prohibited. End User is solely responsible for compliance related to the manner in which End User chooses to use the Arbor Cloud Service, including End User’s transfer and processing of Content and the region in which any of the foregoing occur. End User is solely responsible for ensuring that all users of End User’s account are not Denied Parties.
9. CHANGES TO THE SUPPLEMENTAL TERMS.
9.1 Arbor may make changes to the Supplemental Terms (including the Service Level Agreement) at any time by posting a revised version at www.arbornetworks.com/cloud-suppterms and any successor site designated by Arbor (“Arbor Cloud Site”). It is your responsibility to check the Arbor Cloud Site regularly for modifications to the Supplemental Terms. Except with respect to changes in the AUP, such changes shall apply only to orders placed for the applicable Arbor Cloud Service after the aforementioned changes take effect.

EXHIBIT A
SERVICE LEVEL AGREEMENT FOR ARBOR CLOUD SERVICE

This Service Level Agreement (“SLA”) for the Arbor Cloud Service is subject to the terms of the Agreement and Supplemental Terms. In the event of a conflict between the terms of the Agreement or the Supplemental Terms and the terms of this SLA, this SLA shall control.

1. Definitions

1.1 “Credit” shall mean the credit issued for a Service Outage and shall be the pro-rated value of one (1) day of fees determined by dividing the Service Package Fees by the number of days in the calendar month in which the Service Outage occurs.

1.2 “Service Outage” shall mean an event where Arbor has failed to meet any of the SLAs in Section 2.2 below and no exception in 2.3 applies.
1.3 “Arbor Cloud Platform” shall mean the integrated hardware and software combined to form the network deployed and controlled by Arbor in connection with the provision of the Services, excluding: a) any third party or on-premise hardware, software or networks not owned, deployed and under the control of Arbor; or b) telecommunications services or infrastructure providing a connection between any Arbor servers used in the provision of the Services.

1.4 “Services” shall mean the Arbor Cloud Services.

1.5 “DNS Redirection–based Services” shall mean redirection of End User traffic to the Arbor Cloud Platform by changing Domain Name System (DNS) record for End User hostname.

1.6 “BGP Redirection–based Services” shall mean redirection of End User traffic to the Arbor Cloud Platform by injecting a Border Gateway Protocol (BGP) route into the Internet routing table.

1.7 “Standard Setup” shall mean initial provisioning of End User network and/or hostname information into the Arbor Cloud Platform within normal timeframes as defined in Section 2.2B of this SLA.

1.8 “Standard Updates” shall mean changing End User network and/or hostname information in the Arbor Cloud Platform within normal timeframes as defined in Section 2.2C of this SLA.

1.9 “Emergency Setup” shall mean initial provisioning of End User DNS hostname information into the Arbor Cloud Platform within an expedited timeframe as defined in Section 2.2D of this SLA.

1.10 “Emergency Updates” shall mean changing End User DNS hostname information in the Arbor Cloud Platform within an expedited timeframe as defined in Section 2.2E of this SLA.

1.11 “Scheduled Maintenance” shall mean pre-defined periods of time where the Services may be unavailable or have degraded capacity due to the occurrence of planned system changes.


2. Service Levels

2.1 During the Term, Arbor will provide the Services without a Service Outage.

2.2 A Service Outage shall, subject to Sections 2.3 and 4.2 below, be deemed to occur in the event that the following Service Levels are not met:

A. Arbor Cloud Platform: 99.999% Availability. The Arbor Cloud Platform shall not be unavailable for more than five (5) consecutive seconds in any calendar month.
B. Standard Setup: 72 Hours. Standard Setup shall be performed within seventy two (72) hours of the following events: (i) for DNS Redirection-based Services, completion of the provisioning call and acceptance of configuration submission by Arbor; (ii) for BGP-Redirection based Services, completion of the provisioning call and acceptance of configuration submission by Arbor.
C. Standard Updates: 72 Hours. Standard Updates shall be performed within seventy two (72) of the following events: (i) for DNS Redirection-based Services, completion of the provisioning call and acceptance of configuration submission by Arbor; (ii) for BGP-Redirection based Services, completion of the provisioning call and acceptance of configuration submission by Arbor.
D. Emergency Setup: 4 Hours. (Only Applies to DNS Based Redirection-Services). Emergency Setup shall be performed within four (4) hours of acceptance of configuration submission by Arbor.
E. Emergency Updates: 4 Hours. Emergency Updates shall be performed within four (4) hours of acceptance of configuration submission by Arbor.
F. Time to Mitigate: 5 Minutes/15 Minutes. Arbor shall begin mitigation within: (i) five (5) minutes for Layer 3 & 4 attacks from the time traffic is redirected to Arbor Cloud Platform and Arbor has detected malicious traffic; and (ii) fifteen (15) minutes for Layer 7 attacks from the time traffic is redirected to Arbor Cloud platform and Arbor has detected malicious traffic. Each attack vector change shall start a new Time to Mitigate. Mitigation shall mean the cleaning of the traffic such that no more than five percent (5%) of dirty/malicious traffic shall be passed to End User Endpoint(s).
G. Mitigation Incident Initiation: 15 Minutes. A Mitigation Incident conference bridge shall be initiated with available Arbor staff within 15 minutes of an End User initiating a mitigation request by a phone call to Arbor Customer Support.
H. BGP Route Announcement: 5 Minutes. For BGP End Users only, Arbor shall announce the End User BGP route to the Internet within 5 minutes of all parties agreeing to initiate a mitigation and the End User completing any necessary routing changes on their End User premise equipment.
2.3 A Service Outage shall not be deemed to occur when the event is due to any of the following: (a) Inaccurate and/or insufficient information or configuration information or configuration information provided by End User; (b) Misuse of the Services by End User; (c) Traffic redirection delays (e.g. DNS TTLs and BGP route propagation delays) (outside of Arbor control); (d) Non-performance or other negligent or unlawful acts or failure to act by End User or its agents or suppliers; (e) Network unavailability outside of End User Endpoint(s), failure to implement ACLs or other documented best practices); (g) Lack of End User participation in DDoS Mitigation efforts, including Arbor’s inability to reach End User by phone or End User’s lack of English-speaking representatives available to coordinate and communicate with Arbor during a DDoS attack); (h) An End User provisioning request is not accepted by Arbor; (i) Acts of God or events of Force Majeure (as defined in Section 8 of the Agreement); (i) Scheduled or emergency maintenance; (j) Suspension or termination of the Services by Arbor in accordance with the terms of the Agreement; or (k) End User has not directed all End User traffic for the Endpoint to the Arbor Cloud Platform.
3. Scheduled Maintenance.
Arbor may perform maintenance on its systems at any time but will be limited to a maximum of six (6) hours of scheduled maintenance during any calendar week. Scheduled Maintenance may result in the End User’s inability to access (a) client-side web-based and mobile user interfaces, (b) applications programming interfaces (APIs), or other End User accessible software. Arbor will maintain a standard maintenance window on Sunday beginning at 0400 AM Greenwich Mean Time (GMT), but may initiate an additional maintenance window during a weekday at a time period that is communicated to the End User at least forty-eight (48) hours in advance. Additionally, Arbor may take an emergency maintenance outage of no more than four (4) hours once per month with four (4) hours advanced notice. Notice of Scheduled Maintenance will be provided to End User’s designated point of contact by email or by a notification in the Arbor Cloud web based user interface. The Arbor Cloud Platform will continue to be available for mitigation during Scheduled Maintenance.
4. Remedies for Service Outages.
4.1 Arbor shall, in good faith, determine whether a Service Outage occurred based on Arbor’s records and data. In the event of a Service Outage, the following Credits will apply:

A. For a Service Outage occurring with respect to the SLA provided in 2.2.A: if the Service Outage is greater than five (5) seconds but less than or equal to five (5) minutes, one (1) Credit shall apply; if the Service Outage is greater than five (5) minutes but less than or equal to one (1) hour, five (5) Credits shall apply; if the Service Outage lasts more than one (1) hour, ten (10) Credits shall apply.

B. For any Service Outage occurring with respect to the SLAs provided in 2.2.B and 2.2.C: if the Service Outage is greater than one (1) day but less than or equal to seven (7) days, one (1) Credit per day of Service Outage shall apply; if the Service Outage is greater than seven (7) days, ten (10) Credits shall apply.

C. For any Service Outage occurring with respect to the SLAs provided in 2.2.D and 2.2.E: if the Service Outage is greater than one (1) hour, one (1) Credit per hour of Service Outage shall apply, up to a maximum of ten (10) Credits.

D. For any Service Outage occurring with respect to the SLAs provided in 2.2.F:

(a) if the Service Outage for Layer 3/4 is greater than five (5) minutes, but less than or equal to fifteen (15) minutes, one (1) Credit shall apply; if the Service Outage for Layer 3/4 is greater than fifteen (15) minutes, but less than or equal to sixty (60) minutes, two (2) Credits shall apply; if the Service Outage for Layer 3/4 is greater than sixty (60) minutes, but less than or equal to four (4) hours, five (5) Credits shall apply; and if the Service Outage for Layer 3/4 is greater than four (4) hours, ten (10) Credits shall apply.

(b) if the Service Outage for Layer 7 is greater than fifteen (15) minutes, but less than or equal to thirty (30) minutes, one (1) Credit shall apply; if the Service Outage for Layer 7 is greater than thirty (30) minutes, but less than or equal to sixty (60) minutes, two (2) Credits shall apply; if the Service Outage for Layer 7 is greater than sixty (60) minutes, but less than or equal to four (4) hours, five (5) Credits shall apply; and if the Service Outage for Layer 7 is greater than four (4) hours, ten (10) Credits shall apply.

E. For any Service Outage occurring with respect to the SLAs provided in 2.2.G: If the Service Outage for Mitigation Incident Initiation is greater than fifteen (15) minutes, but less than or equal to thirty (30) minutes, one (1) Credit shall apply; if the Service Outage for Mitigation Incident Initiation is greater than thirty (30) minutes, but less than or equal to sixty (60) minutes, two (2) Credits shall apply; if the Service Outage for Mitigation Incident Initiation is greater than sixty (60) minutes, but less than or equal to four (4) hours, five (5) Credits shall apply; and if the Service Outage for Mitigation Incident Initiation is greater than four (4) hours, ten (10) Credits shall apply.

F. For any Service Outage occurring with respect to the SLAs provided in 2.2.H: If the Service Outage for BGP Route Announcement is greater than five (5) minutes, but less than or equal to fifteen (15) minutes, one (1) Credit shall apply; if the Service Outage for BGP Route Announcement is greater than fifteen (15) minutes, but less than or equal to sixty (60) minutes, two (2) Credits shall apply; if the Service Outage for BGP Route Announcement is greater than sixty (60) minutes, but less than or equal to four (4) hours, five (5) Credits shall apply; and if the Service Outage for BGP Route Announcement is greater than four (4) hours, ten (10) Credits shall apply.


4.2 In the event End User believes a Service Outage has occurred, End User will provide to Arbor all relevant details and documentation supporting End User’s claims of a Service Outage. Any claims for a Credit must be made by End User within seven (7) days after the alleged Service Outage and will be made to Arbor’s Customer Support organization in writing. Claims made more than seven (7) days after the event will not be eligible for any of the remedies described herein. Arbor will investigate the claim and will respond back to End User within ten (10) business days of receipt of the notification of a claim from End User, either (i) accepting End User’s Service Outage claim, or (ii) with all relevant details and documentation supporting a dispute of End User’s Service Outage claim, in which case the parties shall resolve any such dispute promptly in good faith. End User may not accumulate more than fifteen (15) Credits in any calendar month. To make a claim under 2.2.A, End User must send to Arbor Customer Support proof that the platform was unavailable for mitigation. To make a claim under Section 2.2.F, End User must submit a packet capture of the traffic to the affected Endpoint of at least an hour of duration. Credits obtained by End User shall have no cash value but will apply against Service Package Fees in future invoices; provided, however, that if the Credits accrue in the last month of the Term and End User does not renew the Services, Arbor shall provide such Credits to End User in the form of a check within thirty days of the end of the Term. Arbor will reflect Credits on invoices issued one calendar month after the occurrence of the Service Outage. Credits shall only apply to Services provided pursuant to the Service Fee set forth in the Quote and will not apply to any Arbor professional services or any other form of custom development services provided by Arbor. End User’s sole and exclusive remedy, and Arbor’s sole and exclusive liability, in the event Arbor fails to meet this Service Level Agreement, shall be to receive a Credit in accordance with the terms of this Section 4.