Third party contracts and SLAs

1) Purpose and area

Objective: to ensure predictable service quality, data security and privacy, compliance and minimization of operational/legal risks in relations with third parties.
Coverage: PSP/payment gateways, CCM/sanctions/RAP, anti-fraud, game providers/aggregators, marketing/analysis, clouds/CDN/hosting, call centers, affiliate networks, as well as supplier sub-processors.

2) Contract architecture (skeleton)

1. Master Services Agreement (MSA) - general legal terms.
2. Order Form/SoW - scope of services, prices, terms, jurisdictions.
3. SLA - targets and credits.
4. Security & Privacy Addendum - security/privacy, controller/processor roles.
5. DPA/SCCs/DTIA - data processing and cross-border.
6. BCP/DR Application - Fault and Recovery Readiness.
7. Audit/Pen-test Rights.
8. Change Control - API/SDK version, notifications and backward compatibility.
9. Termination & Exit/Transition - transfer/delete data, escrow, migration assistance.

3) SLA, SLO и OLA

SLA (legal purposes): are fixed in the contract; for violation - credits/fines.
SLO (engineering goals): internal target levels (can be stricter than SLA).
OLA (internal agreements): allocation of responsibilities within our team.

3. 1 SLA table example

Indicator	Target (month)	Measurement	Credit/penalty
Uptime service	≥ 99. 9%	external monitoring/P95	5–10% fee
API latency P95	≤ 300 ms	AWS/Metrics	fix. credit
Errors 5xx/day	≤ 0. 1% of requests	logs/showcase	credit for excess
Critical incident (reaction)	≤ 15 min	war-room protocol	fix. penalty
Incident High (remediation)	≤ 30 days	CAPA-report	penalty/right to terminate

💡 Gluing with business: for PSP/game providers add KPI on conversions/authorizations, for KYC - TAT/precision, for anti-fraud - latency/decision coverage.

4) Security & Privacy Addendum (key points)

Encryption: at rest/in transit; key management (KMS/HSM), key division by region/tenant.
Accesses and logs: named accounts, RBAC/ABAC, JIT/PAM for admins; immutable logs (WORM), hash chains, export logs on demand.
Minimization and masking: PII is masked by default; disallowing data recycling.
Incidents: notification ≤ 72 hours, joint war-room, access to artifacts/logs, coordination of regulator/user notifications.
Sub-processors: registry, 30 days ≥ notice, right of objection/audit, same security standards.
Cross-border: DPA + SCCs/IDTA and DTIA prior to transfer; location of data/keys by agreement.
Retention/deletion: retention matrix, confirmation of destruction (including backups) when offboarding.

5) BCP/DR and robustness

RTO/RPO: fix target values (for example, RTO ≤ 4 hours, RPO ≤ 15 minutes for Tier-1).
Tests: at least 1-2 times a year; provision of protocols.
Geo-redundancy: requirement for fault tolerance of regions/zones.
Degradation modes: documented degradation modes (read-only, reduced limits, graceful fallback).
Service Credits vs. Termination: escalation in case of repeated violations (3 strikes).

6) Audit rights and penetration tests

Documentary audit: ISO/SOC2/PCI (if applicable), penetration test reports, CAPA.
Technical check: webhook/mTLS/versioning signature test, rate-limit.
Frequency: yearly for Tier-1/2, ad-hoc for incidents or major changes.

7) Change Control

API/SDK versioning: semantic, N-1 support ≥ 6-12 months

Notifications: major - ≥ 90 days, minor - ≥ 30 days.
Backward compatibility: no breaking-changes without migration window and sandbox.
Release notes: required; test environments and keys.

8) Liability, indemnity, confidentiality

Liability cap: basic cap (for example, 12 × month fee), carve-out for data leakage/intent/IP violations/sanctions.
Indemnity: for third party claims (IP violation/leak/non-compliance with law).
Confidentiality: period of protection (e.g. 5 years after termination), trade secret regime, permitted disclosures (regulator/court).
Insurance: Provider cyber insurance requirement (limits).

9) Termination, Exit и Escrow

Exit plan: data export (CSV/Parquet/JSON formats), schemas, metadata; X-day migration support.
Deletion: confirmation of destruction of the working copy and backups; closing act.
Escrow: source code/key artifacts for critical SDKs/agents - depositing with a trusted provider, disclosure conditions.

10) Financial Terms

Billing model: fix/usage-based, minimum guarantees, caps for growth.
Service credits: not an "exclusive remedy" - we retain the right to termination/damage.
Concentration risk: multi-vendor option and traffic balancing; price revisions when SLA falls.

11) Samples of items (fragments)

11. 1 SLA (latency and uptime)

💡 The Supplier shall ensure availability of the Service not less than 99. 9% per calendar month and P95 latency ≤ 300 ms. Achievement of goals is confirmed by a jointly agreed monitoring system. In case of non-fulfillment of the goals, service credits are applied according to Appendix A. Repeated non-fulfillment within three consecutive months gives the Customer the right to early termination without fines.

11. 2 Notification Incident

💡 The Supplier shall notify the Customer of a security incident affecting the Customer's data not later than 72 hours from the moment of detection, provide a timeline, description of the affected data, measures taken and DPO contact. The Parties shall immediately organize a joint war-room.

11. 3 Sub-processors

💡 The Supplier shall publish and maintain an up-to-date sub-processor register and notify the Customer of any changes at least 30 days in advance. The Customer may object to the new sub-processor; in such a case, the parties would agree on alternatives or an exit plan.

11. 4 Change Control

💡 Any breaking changes API/SDK requires 90 days notice and N-1 compatible mode for at least 6 months, as well as sandbox environment and migration instructions.

11. 5 Data deletion at termination

💡 Within 30 days after termination, the Supplier shall provide data export and confirm deletion of all copies, including back-up copies, except for copies which it is legally obliged to keep (restricted and subsequently deleted).

12) RACI (enlarged)

Activity	Business Owner	Security	DPO/Privacy	Compliance/Legal	Finance	SRE/Data	Procurement
Business Case and KPIs	A/R	C	C	C	C	C	C
SLA/SLO/KPI design	R	A/R	C	C	C	R	I
Security & Privacy Addendum	C	A/R	A/R	A/R	I	C	I
DPA/SCCs/DTIA	I	C	A/R	A/R	I	I	I
BCP/DR requirements	C	A/R	C	C	I	R	I
Audit/Pentest Rights	C	A/R	A	A	I	R	I
Change Control	C	A/R	C	C	I	R	I
Termination/Exit/Escrow	A/R	C	C	A/R	A/R	R	R

13) Checklists

13. 1 Before signing

Business owner and supplier criticality defined
SLA/SLO/KPI and service credits agreed
Signed by Security & Privacy Addendum, DPA/SCCs/DTIA
BCP/DR (RTO/RPO) and test plan approved
Audit/Penetration Rights, Sub-Processor Register with Advance Notice
Change Control: versions, migration windows, sandbox
Exit plan, export formats, delete/backups, escrow (if critical)
Finance: charging model, caps, indexing conditions

13. 2 Quarterly Review (Tier-1/2)

SLA/SLO execution, credits/penalties accounted for
Updating Certificates/Reports and Sub-Processor List
DR Test Results, RTO/RPO Confirmation
API/SDK Changes and N-1 Compatibility
Incidents/Vulnerabilities, CAPA Closure
Concentration risks and multivendor

13. 3 Offboarding

Revoked accesses/keys/webhooks
Full export received, integrity checked
Confirmed deletion of working copies and backups
Closing/Handover Certificates; updated vendor register and Data Map

14) Metrics (KPI/KRI)

SLA Compliance: ≥ 99% goals/quarter; repeated violations → escalation.
Incident Notification ≤72ч: 100%.

DR Evidence: 100% Tier-1 with up-to-date tests in 12 months

Change Stability: 0 critical breaking-changes without migration window.
Export/Deletion Compliance: 100% termination confirmations.
Audit Closure: ≥ 95% of High finds are closed ≤ 30 days.
Concentration Risk: the share of traffic/revenue per supplier ≤ the set threshold.

15) Implementation Roadmap

Weeks 1-2: vendor inventory, classification and criticality, MSA/SLA/Addendum/DPA templates, sub-processor registry.
Weeks 3-4: approval of KPI/SLO, BCP/DR requirements, audit rights and change control; pilot on Tier-1.
Month 2: implementation of SLA monitoring, dashboards, credit accounting; launch of quarterly reviews.
Month 3 +: certificate/term verification automation, DR stress tests, multi-vendor development and escrow for critical integrations.

TL; DR

Strong contract = clear SLA/SLO + credits, hard Security & Privacy Addendum (DPA/SCCs/DTIA, logs, 72-h notifications), BCP/DR with RTO/RPO and tests, audit rights and change control, transparent exit/escrow. This reduces risk, speeds integration and makes third-party relationships manageable and provable.

Third party contracts and SLAs

TL; DR

Get in Touch

Quick Contact

The video will be updated soon

We are currently very busy with projects