Arbor Cloud Supplemental Terms and Conditions

Arbor Cloud Supplemental Terms and Conditions

These Arbor Cloud Supplemental Terms and Conditions (“Supplemental Terms”) are an addendum to and supplement the terms of the Licensing and Services Agreement (the “Agreement”) and are incorporated therein. Together, the Agreement and these Supplemental Terms govern Your (the “End User”) use of the Arbor Cloud Services. In the event of a conflict between these Supplemental Terms and the Agreement, these Supplemental Terms shall control with respect to Arbor Cloud Services. Capitalized terms not otherwise defined in these Supplemental Terms shall have the meaning ascribed to them in the Agreement. 

  1. SERVICE DEFINITIONS

The following definitions shall apply to the capitalized terms used herein.

1.1 “/24 Prefix” means a block of two hundred fifty-four (254) continuous IP addresses.

1.2 “Arbor Cloud Platform” means the network to which internet-based traffic for an Endpoint must be directed in order to have the Arbor Cloud Services performed.

1.3 “Arbor Cloud Services” means the on-demand, End User-activated, cloud-based, service which “cleans” or “scrubs” certain internet-based, malicious, attack traffic from a stream of internet-based traffic directed at the End User’s Endpoint and, where applicable, any supplemental services set forth on the order Form.

1.4 “Attack” or “Attack Incident” shall mean an event in which malicious traffic (e.g. DDoS), is directed at an Endpoint which is on the Arbor Cloud Platform. The determination as to whether traffic is Attack traffic shall be determined solely by Arbor.

1.5 “AUP” shall mean the Acceptable Use Policy which is described in Section 3.11.

1.6 “BGP” shall mean Border Gateway Protocol.

1.7 “Change” means adjustments to the main provisioning of the service (e.g., changing subnets monitored, GRE tunnels, and changing DNS hostnames). Mitigation configurations, countermeasures, and black/white lists are not counted as Changes for purposes of determining the Standard Update Fee or the Emergency Update Fee as described in Section 5.2.

1.8 “Clean Traffic” shall mean the 95th percentile peak Mbps of legitimate End User internet traffic going in to or out of the Arbor Cloud Platform for an Endpoint, which is processed by the Arbor Cloud Service on a per Mitigation Incident basis.

1.9 “Content” shall be as defined in Section 6.2.

1.10 “DNS” shall mean Domain Name System.

1.11 “Endpoint(s)”, as used herein, means that part of an End User’s infrastructure subject to protection by the Arbor Cloud Services and for which End User or Arbor has activated the Arbor Cloud Services by directing traffic to the Endpoint onto the Arbor Cloud Platform.

1.12 “Incident” means an event wherein End User has directed internet-based traffic for an Endpoint to the Arbor Cloud Platform and shall include both Attack Incidents and Non-Attack Incidents.

1.13 “Location” for BGP customers only, means router endpoint to terminate GRE (Generic Routing Encapsulation) tunnels connected to the Arbor Cloud Platform.

1.14 “Mitigation Incident” means either (a) the event commencing when Arbor announces the requested /24 prefix(es) out of the Arbor Cloud Platform and ceases when End User contacts Arbor pursuant to then-current Arbor policies and directs Arbor to cease such announcement(s) or (b) an event where more than twenty-five (25) kilobits per second (“Kbps”) of traffic flows through the End User’s assigned DNS Redirection VIP address on the Arbor Cloud Platform.

1.15 “Non-Mitigation Incident” shall mean a Migration Incident in which the End User has directed internet-based traffic for an Endpoint to the Arbor Cloud Platform and there has been no Attack traffic for a period of seventy-two (72) consecutive hours.

1.16 “Provisioning Process” means Arbor’s then-current process for provisioning of an Endpoint, a change to configuration or directing End User traffic to or away from the Arbor Cloud Platform.

1.17 “VIP(s)” or “DNS Redirection VIP(s)” for DNS customers only, means the Arbor-assigned IP address on the Arbor Cloud Platform which terminates to only one (1) End User hosted IP address to send Clean Traffic & receive outbound internet traffic.

  1. PROVISION OF ARBOR CLOUD SERVICES

2.1 End User acknowledges that deployment on the Arbor Cloud Platform may require configuration which takes several days and that in such instance, any activation of Arbor Cloud Services on an expedited basis shall require deployment on the DNS-based platform rather than the BGP-based platform as Arbor, in its reasonable discretion, determines is appropriate.

2.2 Arbor shall calculate the End User’s total amount of used Clean Traffic in Mbps, at the ninety-fifth (95th) percentile during each Mitigation Incident to confirm they are within their total contracted Clean Traffic amount. Clean Traffic shall be determined by periodically measuring End User’s Clean Traffic bandwidth utilization running through the Arbor Cloud Platform. At the end of a measurement period (Mitigation Incident), the utilization measurements are ordered from highest to lowest and the top five percent (5%) of the traffic measurements discarded. The next highest measurement for the inbound or outbound traffic is considered the ninety-fifth (95th) percentile Clean Traffic.

2.3 In the event of a Mitigation Incident, any traffic which is directed to the Arbor Cloud Platform that is not for a pre-provisioned domain, protocol or port will be blocked. Attack traffic may be mitigated as far “upstream” as possible, including internet network provider access control lists (ACLs). In such event, the End User will not be assessed any Clean Traffic Overage Fees (defined in Section 5.1.3) related to the volume of the attack traffic. Clean Traffic Overage Fees shall only be incurred when the actual quantity of Clean Traffic measured during a Mitigation Incident exceeds the amount of Clean Traffic contracted for by End User.

2.4 For DNS customers only, the Arbor Cloud Service may be provisioned to protect up to ten (10) ports per domain for standard TCP based application layer protocols, which may include the following: Web (e.g. HTTP, HTTPS), API (e.g. SOAP, XML, REST), Email (e.g. POP/POP3, SMTP, IMAP/IMAP4), Database (e.g. MySQL, MS SQL, Oracle) & Other (e.g. Telnet, SSH, FTP).

2.5 The Arbor Cloud Service includes Layer 4 rate limiting protection for HTTPS traffic provisioned on the Arbor Cloud Platform. The Arbor Cloud Service does not open HTTPS packets for “inspection”, “cleaning” or “scrubbing” unless the End User has elected to utilize a packet inspection service, if offered, at the application Layer 7 level on a per domain, per SSL certificate basis. This packet inspection service requires End User to provide Arbor with valid SSL certificates to be loaded on to the Arbor Cloud Platform for the traffic that shall be subject to HTTPS packet inspection.

2.6 Support services for the Arbor Cloud Service are provided only in English.

  1. END USER OBLIGATIONS

3.1 End User acknowledges that Arbor Cloud Services may be used only for End User’s own internal business purposes (and may not be used to provide services to third parties unless expressly agreed to by Arbor in writing) or to otherwise compete with Arbor.

3.2 End User agrees that the successful and timely performance of the Arbor Cloud Services requires End User’s good faith cooperation and participation. Accordingly, End User agrees to fully cooperate with Arbor including without limitation: (i) providing relevant information reasonably requested by Arbor on the Endpoints prior to the activation of the Arbor Cloud Services pursuant to the Provisioning Process with respect to each Endpoint, and during the provision of Arbor Cloud Services shall inform Arbor of any changes to such information, (ii) provide all other information reasonably requested by Arbor which Arbor determines is reasonably necessary in order to provide the Arbor Cloud Services, and (iii) take such other actions that Arbor determines is reasonably necessary to enable Arbor to perform the Arbor Cloud Services. In addition, End User agrees to make the necessary configuration changes to their infrastructure to enable the performance of the Arbor Cloud Services. End User acknowledges that the Arbor Cloud Services may be delayed or not completed if End User does not cooperate with Arbor, or if Arbor’s performance is otherwise delayed or prevented by End User, and Arbor shall not be held accountable for any such delays as a result of End User’s failure to take the foregoing actions.

3.3 For BGP-based services, End User must provide BGP and GRE (Generic Routing Encapsulation) capable device(s) and properly configure such device(s).

3.4 End User acknowledges that in order for Arbor to provide the Arbor Cloud Services, End User’s internet traffic for the Endpoint must first be redirected to the Arbor Cloud Platform.

3.5 End User acknowledges that operation and performance of the Arbor Cloud Services involves repeated filtering of traffic to the Endpoint and End User expressly consents to the same. End User hereby grants Arbor, for the Term, a non-exclusive, non-transferable, and royalty-free license to access any part of the internet traffic flowing to the Endpoint and any application traffic contained therein for the purposes described in these Supplemental Terms.

3.6 End User shall be solely responsible for the direction of all internet traffic for an Endpoint by following Arbor’s procedures then in effect under the Provisioning Process (which may include, by way of example, contacting Arbor’s support team and having Arbor announce or cease announcing the requested /24 prefixes or changing DNS to DNS Redirection VIPs).

3.7 End User shall have a technical contact available during the entirety of a Mitigation Incident that speaks English to enable End User to interact with Arbor’s support team.

3.8 Prior to engaging Arbor to start a Mitigation Incident, End User shall:

3.8.1 if subscribed to a DNS based service, set DNS TTL (Time to Live) at 300s for all protected infrastructure

3.8.2 whitelist Arbor IP addresses

3.9 End User shall provide Arbor with written instructions on the End User’s escalation and authorization protocols for its emergency/incident response procedures for DDoS attacks. This information will be provided to Arbor during the Provisioning Process.

3.10 Unless End User purchases Arbor Cloud Services as an “always on” type service, End User acknowledges that the Arbor Cloud Service is an on-demand service for use during Attack Incidents only and is not meant to be used as an always-on service during periods when an Attack is not occurring or when Arbor has not explicitly agreed to continue for another mitigation period. Any such use when an Attack is not occurring may incur additional fees in accordance with Section 5.1.

3.11 End User shall comply with the Acceptable Use Policy for Arbor Cloud Services (“AUP”), the current terms of which are set forth in this Section 3.11. End User shall not use, or allow use of, the Arbor Cloud Service in violation of the AUP, including any of the following types of abuses (“Abuses”): (a) use of the Arbor Cloud Service in an unlawful manner or for an unlawful purpose, (b) use of the Arbor Cloud Service in a manner that, in Arbor’s reasonable discretion, directly or indirectly produces or threatens to produce a negative effect on the Arbor Cloud Service network other than in a manner for which the Arbor Cloud Service network was designed or that interferes with the use of the Arbor Cloud Service network by other customers or authorized end users, including, without limitation, overloading servers or causing portions of the Arbor Cloud Service network to be blocked, or (c) excessive or prolonged use of the Arbor Cloud Service while not actively mitigating a DDoS attack or incident.

3.12 Arbor may suspend an Endpoint or the Arbor Cloud Services, as applicable, if, in Arbor’s reasonable determination, an Abuse occurs. Such suspension shall remain in effect until End User corrects the applicable Abuse. In the event that, in Arbor’s reasonable determination, an Abuse is critically impacting, or threatens to impact critically, the Arbor Cloud Service network or servers, Arbor may suspend an Endpoint or the Arbor Cloud Service, as applicable, immediately and without prior notice. In the event that an Abuse is not critically impacting the Arbor Cloud Service network or threatening to do so, Arbor shall give prior notice of any suspension. End User’s failure to correct any Abuse within thirty (30) days after receipt of notice will entitle Arbor to terminate Arbor Cloud Services effective immediately upon Arbor’s delivery of the termination notice.

3.13 Arbor may discontinue the Arbor Cloud Service at any time upon seventy-five (75) days prior written notice provided that such right shall not be utilized by Arbor as a termination for convenience but shall only be used where such discontinuance would apply to all or substantially all of Arbor’s Arbor Cloud Services customers.

3.14 Only End User is authorized to provide Content to Arbor for provision of the Arbor Cloud Services and End User is responsible for such Content (whether such Content actually belongs to End User or to End User’s customers). End User will be deemed to have taken any action that End User permits, assists or facilitates any person or entity to take related to the Agreement and Supplemental Terms, the Content or use of the Arbor Cloud Services.

  1. TERM AND TERMINATION

The Arbor Cloud Service shall commence on Arbor’s acceptance of a purchase order from End User (or, where applicable, from an authorized Arbor reseller on End User’s behalf) and shall continue in effect for the term set forth on the Form (“Initial Term”). Upon expiration of the Initial Term, the Arbor Cloud Service will be renewed automatically for successive twelve (12) month periods (“Renewal Term(s)”) unless either party gives written notice of its intent not to renew the Arbor Cloud Service at least thirty (30) days prior to the end of the Initial Term or the then-current Renewal Term (the Initial Term and any Renewal Terms, collectively the “Term”). End User shall give any notice of non-renewal by sending an e-mail to [email protected].

  1. PAYMENTS AND FEES.

5.1 End User shall pay Arbor the service fees set in the Form (“Service Package Fee”). The Service Package Fee shall be invoiced (directly through to the End User or through the applicable Arbor authorized reseller) on an annual recurring basis unless otherwise specified on the Form commencing upon Arbor’s acceptance of a purchase order from End User (or, where applicable, from an authorized Arbor reseller on End User’s behalf). The Service Package Fee includes the domains, Locations and /24 prefixes indicated on the Form. Additional domains, Locations and /24 prefixes may be added to the package for an additional fee based upon a quote agreed to by the End User at the time of requesting such additional services. Additional fees that may be charged to End User based upon End User’s use of the Arbor Cloud Services (the pricing for which can be obtained, directly from Arbor if Arbor Cloud Services are purchased directly from Arbor, or through the applicable Arbor authorized reseller), include the following:

5.1.1 Mitigation Incident Fees. The Mitigation Incident Fee shall mean the fee that applies to a Mitigation Incident above and beyond the Mitigation Incidents that are included in the Service Package Fee. The Mitigation Incident Fee shall cover a period of up to seventy-two (72) consecutive hours or any portion thereof. Mitigation Incidents longer in duration than seventy-two (72) consecutive hours are subject to Mitigation Incident Fees for each period of consecutive seventy-two (72) hours or any part thereof.

5.1.2 Non-Mitigation Incident Fees. The Non-Mitigation Incident Fees are applicable only when purchasing Arbor Cloud Services that include unlimited mitigations. The Non-Mitigation Incident Fee shall mean the fee applicable to use of the Arbor Cloud Service during a Non-Mitigation Incident and shall apply every seventy-two (72) hours or portion thereof wherein the End User directs internet-based traffic for an Endpoint to the Arbor Cloud Platform. Use of the Arbor Cloud Service when an Attack is not occurring for a period of 72 consecutive hours is considered a Non-Mitigation Incident and will be assessed a Non-Mitigation Incident Fee.

5.1.3 Clean Traffic Overage Fees. The Clean Traffic Overage Fee shall mean the fee, calculated on a per megabits per second (“Mbps”) basis, that will apply in the event that amount of Clean Traffic to the Arbor Cloud Platform during a Mitigation Incident exceeds the amount of traffic contracted for by the End User. End User will be charged Clean Traffic Overage Fees if, during a Mitigation Incident or a Non-Mitigation Incident, Arbor determines that the 95th percentile peak clean traffic flowing through the Arbor Cloud Platform exceeds the contracted Clean Traffic amount. End User will be charged a per Mbps overage fee for the additional, peak Clean Traffic.

5.2 The following additional fees may be charged by Arbor (directly through to the End User or through the applicable Arbor authorized reseller) as a result of additional services that End User may request: Standard Setup Fees, Emergency Setup Fees, Standard Update Fees and Emergency Update Fees or if End User exceeds its allotted mitigations or capacity. With respect to these additional services, after End User’s request for these additional services, (i) Arbor shall issue a quote describing the additional services and the applicable additional fees, and (ii) Arbor shall not be obligated to commence with any additional services until a purchase order has been accepted by Arbor with respect to such additional services; provided, however, during emergency situations Arbor and End User may agree to proceed immediately based on mutual agreement followed by a purchase order to be issued by End User within thirty (30) days following receipt of the applicable quote. A description of some of these charges are as follows:

5.2.1 Standard Update Fees. The Standard Update Fee shall be applied when End User has requested more than two (2) Changes per month.

5.2.2 Emergency Setup Fees. The Emergency Setup Fee shall be incurred in the event that, in response to an End User request, provisioning of the Arbor Cloud Service is performed as described in Section 2.2 (D) of the SLA (as defined below). The Emergency Setup Fee shall apply in addition to any related Service Package Fees, Mitigation Incident Fees and, if applicable, any Clean Traffic Overage Fees.

5.2.3 Emergency Update Fees. The Emergency Update Fee shall be charged for End User initiated Changes and additions, deletions and updates related to domain names, IP addresses, Locations, ports & protocols performed as described in Section 2.2(E) of the SLA.

  1. WARRANTIES

6.1 Arbor represents that the Arbor Cloud Services will perform as described in the service level agreement attached hereto and incorporated herein as Exhibit A (“SLA”). EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION 6.1 WITH RESPECT TO THE ARBOR CLOUD SERVICES, ARBOR MAKES NO OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE ARBOR CLOUD SERVICES. END USER’S SOLE AND EXCLUSIVE REMEDY, AND ARBOR’S SOLE AND EXCLUSIVE OBLIGATION, WITH RESPECT TO THE ARBOR CLOUD SERVICES AND ANY BREACH OF THE FOREGOING REPRESENTATION IN THIS SECTION 6.1, WILL BE THE REMEDIES SET FORTH IN THE SLA. A breach of the representation in this Section 6.1 or the SLA shall not constitute a breach of End User’s Agreement.

6.2 End User represents and warrants that: (a) End User has all right, title and interest or is the licensee with right to use and/or access all of the Endpoints, applications and/or content provided to perform the Arbor Cloud Services and all of the content accessed at End User’s direction to perform the Arbor Cloud Services (together, “Content”); (b) if the End User utilizes a packet inspection service, that its provision of the SSL certificate for the HTTPS Packet Inspection service and Arbor’s use thereof for provision of the Arbor Cloud Service does not violate any laws, security policies or regulations or infringe the proprietary or privacy rights of any third party; (c) End User shall not use the Arbor Cloud Services for any unlawful purpose; and (d) End User shall comply with the Supplemental Terms. End User further represents that neither the U.S. Bureau of Industry and Security nor any other governmental agency has issued sanctions against End User or otherwise suspended, revoked or denied End User’s export privileges.

  1. INDEMNITY

End User will defend at its own expense any action brought against Arbor, its directors, officers, or employees by a third party to the extent that the action is based on a claim, suit, or proceeding arising from or relating to (i) the breach of any representation or warranty set forth in Section 6.2 above; (ii) any third party claim that Arbor’s provision of the Arbor Cloud Service to Endpoints designated by End User in connection with performing the Arbor Cloud Services for End User is not authorized; or (iii) End User-provided Content, including without limitation, any claim involving alleged infringement or misappropriation of any patent, copyright, trademark, trade secret or other third-party intellectual property rights by such Content. This Section 7 shall survive termination of the Arbor Cloud Services and the Agreement.

  1. EXPORT REGULATION

In addition to the export controls provisions contained in the Agreement, End User will not use the Arbor Cloud Service to export or re-export any technical data or software to the list of U.S. embargoed countries or to any person or entity on the U.S. Department of Commerce Denied Persons List or on the U.S. Department of Treasury's lists of Specially Designated Nationals, Specially Designated Narcotics Traffickers or Specially Designated Terrorists (together, “Denied Parties”). Access to the Arbor Cloud Service: (a) from the list of U.S. embargoed countries, or (b) by Denied Parties is strictly prohibited. End User is solely responsible for compliance related to the manner in which End User chooses to use the Arbor Cloud Service, including End User’s transfer and processing of Content and the region in which any of the foregoing occur. End User is solely responsible for ensuring that all users of End User’s account are not Denied Parties.

  1. CHANGES TO THE SUPPLEMENTAL TERMS.

Arbor may make changes to the Supplemental Terms (including the AUP and/or the SLA) at any time by posting a revised version at https://www.netscout.com/arbor-cloud-supplemental-terms-and-conditions and any successor site designated by Arbor (“Arbor Cloud Site”). It is your responsibility to check the Arbor Cloud Site regularly for modifications to the Supplemental Terms, the AUP and/or the SLA. Except with respect to changes in the AUP, such changes shall apply only to orders placed for the applicable Arbor Cloud Service after the aforementioned changes take effect. All changes to the AUP shall become effective immediately.

EXHIBIT A TO SUPPLEMENTAL TERMS

SERVICE LEVEL AGREEMENT

FOR ARBOR CLOUD SERVICE

This Service Level Agreement (“SLA”) for the Arbor Cloud Service is attached to and made a part of the Arbor Cloud Supplemental Terms (“Supplemental Terms”) and is subject to the terms of the Licensing Agreement between Arbor Networks, Inc. and the End User (“Agreement”). In the event of a conflict between the terms of the Agreement or the Supplemental Terms and the terms of this SLA with respect to Arbor Cloud Service, the terms of this SLA shall control. Capitalized terms not otherwise defined in this SLA shall have the meaning ascribed to them in the Supplemental Terms.

  1. DEFINITIONS

1.1 “Arbor Cloud Platform” shall mean the integrated hardware and software combined to form the network deployed and controlled by Arbor in connection with the provision of the Services, excluding: (a) any third party or on-premise hardware, software or networks not owned, deployed and under the control of Arbor; or (b) telecommunications services or infrastructure providing a connection between any Arbor servers used in the provision of the Services.

1.2 “BGP Redirection–based Services” shall mean redirection of End User traffic to the Arbor Cloud Platform by injecting a Border Gateway Protocol (BGP) route into the Internet routing table. 

1.3 “DNS Redirection–based Services” shall mean redirection of End User traffic to the Arbor Cloud Platform by changing Domain Name System (DNS) record for End User hostname.

1.4 “Emergency Setup” shall mean initial provisioning of End User DNS hostname information into the Arbor Cloud Platform within an expedited timeframe as defined in Section 2.2D of this SLA.

1.5 “Emergency Updates” shall mean changing End User DNS hostname information in the Arbor Cloud Platform within an expedited timeframe as defined in Section 2.2E of this SLA.

1.6 “Service Outage” shall mean an event where Arbor has failed to meet any of the SLAs in Section 2.2 below and no exception in 2.3 applies.

1.7 “Services” shall mean the Arbor Cloud Services.

1.8 “Scheduled Maintenance” shall mean pre-defined periods of time where the Services may be unavailable or have degraded capacity due to the occurrence of planned system changes.

1.9 “Standard Setup” shall mean initial provisioning of End User network and/or hostname information into the Arbor Cloud Platform within normal timeframes as defined in Section 2.2B of this SLA.

1.10 “Standard Updates” shall mean changing End User network and/or hostname information in the Arbor Cloud Platform within normal timeframes as defined in Section 2.2C of this SLA.

  1. SERVICE LEVELS

2.1 During the Term, Arbor will provide the Services without a Service Outage.

2.2 A Service Outage, subject to Sections 2.3 and 4.2 below, shall be deemed to occur in the event that the following Service Levels are not met:

  1. Arbor Cloud Platform: 99.999% Availability. The Arbor Cloud Platform shall not be unavailable for more than five (5) consecutive seconds in any calendar month.
  2. Standard Setup: 72 Hours. Standard Setup shall be performed within seventy-two (72) hours of the following events: (i) for DNS Redirection-based Services, completion of the provisioning call and acceptance of configuration submission by Arbor; or (ii) for BGP Redirection-based Services, completion of the provisioning call and acceptance of configuration submission by Arbor.
  3. Standard Updates: 72 Hours. Standard Updates shall be performed within seventy-two (72) hours of the following events: (i) for DNS Redirection-based Services, completion of the provisioning call and acceptance of configuration submission by Arbor; or (ii) for BGP Redirection-based Services, completion of the provisioning call and acceptance of configuration submission by Arbor.
  4. Emergency Setup: 4 Hours. (Only applies to DNS Redirection-based Services). Emergency Setup shall be performed within four (4) hours of acceptance of configuration submission by Arbor.
  5. Emergency Updates: 4 Hours. Emergency Updates shall be performed within four (4) hours of acceptance of configuration submission by Arbor.
  6. Time to Mitigate: 5 Minutes/15 Minutes. Arbor shall begin mitigation within: (i) five (5) minutes for Layer 3 & 4 attacks from the time traffic is redirected to Arbor Cloud Platform and Arbor has detected malicious traffic; and (ii) fifteen (15) minutes for Layer 7 attacks from the time traffic is redirected to Arbor Cloud platform and Arbor has detected malicious traffic. Each attack vector change shall start a new Time to Mitigate. Mitigation shall mean the cleaning of the traffic such that no more than five percent (5%) of dirty/malicious traffic shall be passed to End User Endpoint(s).
  7. Mitigation Incident Initiation: 15 Minutes. A Mitigation Incident conference bridge shall be initiated with available Arbor staff within 15 minutes of an End User initiating a mitigation request by a phone call to Arbor Customer Support.
  8. BGP Route Announcement: 5 Minutes. For BGP Redirection-based services, Arbor shall announce the End User BGP route to the Internet within 5 minutes of all parties agreeing to initiate a mitigation and the End User completing any necessary routing changes on their End User premise equipment.

2.3 A Service Outage shall not be deemed to occur when the event is due to any of the following: (a) inaccurate and/or insufficient information or configuration information or configuration information provided by End User; (b) misuse of the Services by End User; (c) traffic redirection delays (e.g. DNS TTLs and BGP route propagation delays) (outside of Arbor control); (d) non-performance or other negligent or unlawful acts or failure to act by End User or its agents or suppliers; (e) network unavailability outside of End User Endpoint(s), failure to implement ACLs or other documented best practices); (f) lack of End User participation in DDoS mitigation efforts, including Arbor’s inability to reach End User by phone or End User’s lack of English-speaking representatives available to coordinate and communicate with Arbor during a DDoS attack); (g) an End User provisioning request is not accepted by Arbor; (h) acts of God or events of force majeure (as described in Section 10 of the Agreement); (i) scheduled or emergency maintenance; (j) suspension or termination of the Services by Arbor in accordance with the terms of the Agreement; or (k) End User has not directed all End User traffic for the Endpoint to the Arbor Cloud Platform.

  1. SCHEDULED MAINTENANCE

Arbor may perform maintenance on its systems at any time but will be limited to a maximum of six (6) hours of scheduled maintenance during any calendar week. Scheduled Maintenance may result in the End User’s inability to access (a) client-side web-based and mobile user interfaces, or (b) applications programming interfaces (APIs), or other End User accessible software. Arbor will maintain a standard maintenance window on Sunday beginning at 0400 AM Greenwich Mean Time (GMT), but may initiate an additional maintenance window during a weekday at a time period that is communicated to the End User at least forty-eight (48) hours in advance. Additionally, Arbor may take an emergency maintenance outage of no more than four (4) hours once per month with four (4) hours advanced notice. Notice of Scheduled Maintenance will be provided to End User’s designated point of contact by email or by a notification in the Arbor Cloud web-based user interface. The Arbor Cloud Platform will continue to be available for mitigation during Scheduled Maintenance.

  1. REMEDIES FOR SERVICE OUTAGES

4.1 Arbor shall, in good faith, determine whether a Service Outage occurred based on Arbor’s records and data. For purposes of this Section, “Credit” shall mean the credit issued for a Service Outage and shall be the pro-rated value of one (1) day of fees determined by dividing the Service Package Fees by the number of days in the calendar month in which the Service Outage occurs. In the event of a Service Outage, the following Credits will apply (as illustrated in Schedule 1 attached hereto – SLA Credit Calculation Chart): 

  1. Credit – SLA: Arbor Cloud Platform: 99.999% Availability. For a Service Outage occurring with respect to the SLA provided in 2.2.A: if the Service Outage is greater than five (5) seconds but less than or equal to five (5) minutes, one (1) Credit shall apply; if the Service Outage is greater than five (5) minutes but less than or equal to one (1) hour, five (5) Credits shall apply; if the Service Outage lasts more than one (1) hour, ten (10) Credits shall apply. To make a claim under 2.2.A, End User must send to Arbor Customer Support proof that the platform was unavailable for mitigation. 
  2. Credit –SLA: Standard Setup and Standard Updates: 72 Hours.  For any Service Outage occurring with respect to the SLAs provided in 2.2.B and 2.2.C: if the Service Outage is greater than one (1) day but less than or equal to seven (7) days, one (1) Credit per day of Service Outage shall apply; if the Service Outage is greater than seven (7) days, ten (10) Credits shall apply.
  3. Credit –SLA: Emergency Setup and Emergency Updates: 4 Hours. For any Service Outage occurring with respect to the SLAs provided in 2.2.D and 2.2.E: if the Service Outage is greater than one (1) hour, one (1) Credit per hour of Service Outage shall apply, up to a maximum of ten (10) Credits.
  4. Credit – SLA: Time to Mitigate: 5 Minutes/15 Minutes.  For any Service Outage occurring with respect to the SLAs provided in 2.2.F:

(1) if the Service Outage for Layer 3/4 is greater than five (5) minutes, but less than or equal to fifteen (15) minutes, one (1) Credit shall apply; if the Service Outage for Layer 3/4 is greater than fifteen (15) minutes, but less than or equal to sixty (60) minutes, two (2) Credits shall apply; if the Service Outage for Layer 3/4 is greater than sixty (60) minutes, but less than or equal to four (4) hours, five (5) Credits shall apply; and if the Service Outage for Layer 3/4 is greater than four (4) hours, ten (10) Credits shall apply.

(2) if the Service Outage for Layer 7 is greater than fifteen (15) minutes, but less than or equal to thirty (30) minutes, one (1) Credit shall apply; if the Service Outage for Layer 7 is greater than thirty (30) minutes, but less than or equal to sixty (60) minutes, two (2) Credits shall apply; if the Service Outage for Layer 7 is greater than sixty (60) minutes, but less than or equal to four (4) hours, five (5) Credits shall apply; and if the Service Outage for Layer 7 is greater than four (4) hours, ten (10) Credits shall apply.

To make a claim under Section 2.2.F, End User must submit a packet capture of the traffic to the affected Endpoint of at least an hour of duration; provided, however, if End User is unable to provide the required packet capture of the duration set forth in this sentence, then End User shall provide Arbor with reasonable evidence to enable Arbor to verify the claim.. 

  1. Credit – SLA: Mitigation Incident Initiation: 15 Minutes. For any Service Outage occurring with respect to the SLAs provided in 2.2.G: If the Service Outage for Mitigation Incident Initiation is greater than fifteen (15) minutes, but less than or equal to thirty (30) minutes, one (1) Credit shall apply; if the Service Outage for Mitigation Incident Initiation is greater than thirty (30) minutes, but less than or equal to sixty (60) minutes, two (2) Credits shall apply; if the Service Outage for Mitigation Incident Initiation is greater than sixty (60) minutes, but less than or equal to four (4) hours, five (5) Credits shall apply; and if the Service Outage for Mitigation Incident Initiation is greater than four (4) hours, ten (10) Credits shall apply.
  2. Credit – SLA: BGP Route Announcement: 5 Minutes. For any Service Outage occurring with respect to the SLAs provided in 2.2.H: If the Service Outage for BGP Route Announcement is greater than five (5) minutes, but less than or equal to fifteen (15) minutes, one (1) Credit shall apply; if the Service Outage for BGP Route Announcement is greater than fifteen (15) minutes, but less than or equal to sixty (60) minutes, two (2) Credits shall apply; if the Service Outage for BGP Route Announcement is greater than sixty (60) minutes, but less than or equal to four (4) hours, five (5) Credits shall apply; and if the Service Outage for BGP Route Announcement is greater than four (4) hours, ten (10) Credits shall apply.

4.2 In the event End User believes a Service Outage has occurred, End User will provide to Arbor all relevant details and documentation supporting End User’s claims of a Service Outage. Any claims for a Credit must be made by End User within seven (7) days after the alleged Service Outage and will be made to Arbor’s Customer Support organization in writing. Claims made more than seven (7) days after the event will not be eligible for any of the remedies described herein. Arbor will investigate the claim and will respond back to End User within ten (10) business days of receipt of the notification of a claim from End User, either (i) accepting End User’s Service Outage claim, or (ii) with all relevant details and documentation supporting a dispute of End User’s Service Outage claim, in which case the parties shall resolve any such dispute promptly in good faith. Notwithstanding anything to the contrary set forth herein, (i) End User may not accumulate more than fifteen (15) Credits in any calendar month, and (ii) End User will not be entitled to any Credits if End User is in breach of the Supplemental Terms at the time of the occurrence of the event giving rise to the Credit until End User has cured the breach. In addition, End User will not be entitled to a Credit if the event giving rise to the Credit would not have occurred but for End User’s breach of the Supplemental Terms or misuse of the Arbor Cloud Platform or the Arbor Cloud Services. Credits obtained by End User shall have no cash value but will apply against Service Package Fees in future invoices; provided, however, that if the Credits accrue in the last month of the Term and End User does not renew the Services and is not in default under the terms of the Supplemental Terms or the Agreement, Arbor shall provide such Credits to End User in the form of a check within thirty (30) days of the end of the Term. Arbor will reflect Credits on invoices issued one calendar month after the occurrence of the Service Outage. Credits shall only apply to Services provided pursuant to the Service Fee set forth in the Form and will not apply to any Arbor professional services or any other form of custom development services provided by Arbor. Credits that would be available but for any of the limitations set forth in this section will not be carried forward to future months. End User’s sole and exclusive remedy, and Arbor’s sole and exclusive liability, in the event Arbor fails to provide the Arbor Cloud Services in accordance with the Supplemental Terms and this Service Level Agreement, shall be to receive a Credit in accordance with the terms of this Section 4.

SCHEDULE 1 TO SERVICE LEVEL AGREEMENT

FOR ARBOR CLOUD SERVICE

SLA CREDIT CALCULATION CHART

Credit as described in Section 4.1A

Service Outage for SLA provided in Section 2.2A (Arbor Cloud Platform)

Service Outage Greater Than

Service Outage Less than or Equal to

Amount of Credit

5 seconds

5 minutes

1 Credit

5 minutes

1 hour

5 Credits

1 hour

--

10 Credits

Credit as described in Section 4.1B

Service Outage for SLA provided in Section 2.2B (Standard Setup) and 2.2C (Standard Updates)

Service Outage Greater Than

Service Outage Less than or Equal to

Amount of Credit

1 day

7 days

1 Credit per day of Service Outage

7 days

--

10 Credits

Credit as described in Section 4.1C

Service Outage for SLA provided in Section 2.2D (Emergency Setup) and 2.2E (Emergency Updates)

Service Outage Greater Than

Service Outage Less than or Equal to

Amount of Credit

1 hour

--

1 Credit per hour of Service Outage, up to a maximum of 10 Credits

Credit as described in Section 4.1D(1)

Service Outage for Layer 3/4 SLA provided in Section 2.2F (Time to Mitigate)

Service Outage Greater Than

Service Outage Less than or Equal to

Amount of Credit

5 minutes

15 minutes

1 Credit

15 minutes

60 minutes

2 Credits

60 minutes

4 hours

5 Credits

4 hours

--

10 Credits

Credit as described in Section 4.1D(2)

Service Outage for Layer 7 SLA provided in Section 2.2F (Time to Mitigate)

Service Outage Greater Than

Service Outage Less than or Equal to

Amount of Credit

15 minutes

30 minutes

1 Credit

30 minutes

60 minutes

2 Credits

60 minutes

4 hours

5 Credits

4 hours

--

10 Credits

Credit as described in Section 4.1E

Service Outage for SLA provided in Section 2.2G (Mitigation Incident)

Service Outage Greater Than

Service Outage Less than or Equal to

Amount of Credit

15 minutes

30 minutes

1 Credit

30 minutes

60 minutes

2 Credits

60 minutes

4 hours

5 Credits

4 hours

--

10 Credits

Credit as described in Section 4.1F

Service Outage for SLA provided in Section 2.2H (BGP Route Announcement)

Service Outage Greater Than

Service Outage Less than or Equal to

Amount of Credit

5 minutes

15 minutes

1 Credit

15 minutes

60 minutes

2 Credits

60 minutes

4 hours

5 Credits

4 hours

--

10 Credits