1. Definitions

For the purpose of this Agreement, the following terms have the meanings set forth below:

Term	Definition
Authorized Partner	A reseller, distributor, or channel partner authorized by Insignary to license or support Clarity products to end customers.
Business Hours	Monday through Friday, 09:00–18:00, excluding Insignary-observed public holidays.
Customer	The individual, company, or legal entity that has entered into a license or subscription agreement with Insignary or an Authorized Partner for use of Clarity products.
Customer Data	All data, files, or materials uploaded or submitted by the Customer in connection with use of the SaaS service.
End-of-Life (EOL)	A product version for which Insignary has ceased to provide updates, patches, or technical support.
Incident	An unplanned interruption to, or reduction in quality of, a Clarity service or function reported by a Customer or Authorized Partner.
Insignary Service Desk	Insignary’s primary support portal for ticket submission, status tracking, and knowledge base access.
SaaS Service	The cloud-hosted deployment of Clarity products operated by Insignary on AWS infrastructure.
SLA	This Service Level Agreement, defining Insignary’s support and service commitments.

2. Overview

This Service Level Agreement ("SLA") defines the support structure, response obligations, and service commitments applicable to Insignary Clarity and related products licensed to direct customers and Authorized Partners worldwide.

Authorized Partners are responsible for communicating applicable terms to their end customers. Products in scope: Clarity, Clarity AIR, Clarity SC.

3. Support structure

Insignary operates a two-tier support model designed to ensure timely and effective resolution of all customer issue

Tier	Responsible party	Role
Tier 1	Authorized Partner or Insignary Pre-sales	First point of contact. Initial triage, issue classification, and resolution of standard inquiries.
Tier 2+	Insignary Technical Support	Second line of support. Handles escalated issues, complex technical investigations, and engineering coordination.

Where an Authorized Partner acts as Tier 1, Insignary will provide the partner with necessary technical documentation and product information to enable effective first-line support.

4. Support channels

Customers and Authorized Partners may contact Insignary support through the following channels. SLA response time obligations apply to tickets submitted via the Insignary Service Desk or email only.

#	Channel	Details
1	Insignary Service Desk	Primary channel. Ticket submission, status tracking, knowledge base, and product documentation available via the Insignary support portal.
2	Email	Support requests submitted by email are reviewed and processed by the Pre-sales team. Acknowledgment of receipt is provided directly by the assigned team member.
3	Phone / Other	Available for urgent S1 escalations. Dedicated contact details are provided to the Customer or Authorized Partner at contract execution. Phone and other channels are for coordination purposes and are not subject to SLA response time obligations.

5. Severity definitions

All support tickets must be assigned a severity level at the time of submission. Insignary reserves the right to reclassify a ticket if the reported severity does not accurately reflect the actual impact.

Severity	Initial response	Resolution target
S1 – Critical	4 Business Hours	1 business day (best effort); action plan communicated within 1 business day
S2 – High	1 business day	2 business days (best effort); action plan communicated within 2 business days
S3 – Medium	2 business days	Next scheduled software release
S4 – Low	5 business days	Next scheduled software release, if applicable

6. Response and resolution SLA

Initial response times are measured from the moment a ticket is received via the Insignary Service Desk or email, during Business Hours.

Severity	Initial Response	Resolution Target
S1 – Critical	4 Business Hours	1 business day (best effort); action plan communicated within 1 business day
S2 – High	1 business day	2 business days (best effort); action plan communicated within 2 business days
S3 – Medium	2 business days	Next scheduled software release
S4 – Low	5 business days	Next scheduled software release, if applicable

Resolution targets are provided as guidance and do not constitute a binding commitment. Complex or systemic issues may require additional time. Insignary will communicate status updates proactively for all open S1 and S2 tickets.

7. Escalation process

The following escalation path applies across all regions:

Customer submits ticket via Insignary Service Desk or email
Tier 1 — Authorized Partner or Insignary Pre-sales performs initial triage and response
If unresolved past the initial response window, or severity is S1 / S2: escalated to Insignary Technical Support.
If root cause requires engineering involvement: Insignary Technical Support escalates internally to the Engineering team.
For S1 issues, Insignary will assign dedicated resources and communicate a written action plan within 1 business day of escalation.

Designated escalation contacts for each party will be documented at contract execution and updated as required.

8. Updates and upgrades

During the term of any active license or subscription, Insignary provides the following at no additional charge:

Item	Commitment
Software updates and patches	All bug fixes, patches, and new software releases issued during the license term, including interim maintenance releases and full product releases.
CVE DB updates — Clarity	Weekly; may be skipped if no new vulnerability data is available during the update cycle.
Critical CVE fast-track — Clarity	Out-of-cycle deployment as soon as practicable for CVEs with CVSS ≥ 9.0 or zero-day classification, independent of the regular weekly schedule.
OSS DB updates — Clarity	Monthly.
Clarity AIR	Cloud-based; vulnerability database is continuously maintained and always reflects current data. No manual update action required.
Clarity SC	Software updates provided per release schedule. Clarity SC is an SBOM management platform and does not include a vulnerability DB component.

On-premise customers apply CVE and OSS DB updates via Clarity's built-in update function or a pre-configured automated schedule (pull method). Customers are responsible for applying available updates in a timely manner. Insignary shall not be liable for issues arising from a customer's failure to apply recommended updates.

Products reaching End-of-Life (EOL) status will be announced with a minimum of 90 days' prior notice via email to registered partner and customer contacts, or through the Insignary Service Desk portal. Support and update obligations under this SLA cease upon EOL.

9. Product availability (SaaS / hosted deployments)

Item	Commitment
Uptime	Insignary will use commercially reasonable efforts to achieve a monthly uptime of 99.9% for SaaS services, excluding downtime caused by the circumstances listed under Exclusions. Availability is measured and recorded using AWS CloudWatch monitoring.
Infrastructure	AWS — Korea region (ap-northeast-2) and Japan region (ap-northeast-1, Tokyo).
Planned maintenance notice	Minimum 24 hours in advance via email to the registered partner or customer contact. The notice will include the maintenance window duration and a summary of the work to be performed.
Emergency maintenance notice	As soon as practicable. Insignary will communicate the reason and estimated duration via email and/or the Service Desk portal.

On-premise deployments: infrastructure availability is the customer's responsibility. Commitments in this section do not apply to on-premise installations.

10. Service suspension

Insignary reserves the right to suspend a Customer's or user's access to SaaS services under the following circumstances. Where reasonably practicable, Insignary will provide advance notice prior to suspension.

Scheduled or emergency maintenance necessary to maintain the integrity or security of the service.
Material breach of the applicable license or subscription agreement by the Customer, including failure to make payment beyond any applicable notice and cure period.
The Customer's use of the service causes or is reasonably likely to cause damage to or material degradation of the service for other users.
Insignary receives a binding order from a court, regulatory authority, or other competent body requiring suspension or termination of access.

Suspension does not relieve the Customer of payment obligations for the applicable subscription period, except where suspension is due to Insignary's fault.

11. Customer data handling (SaaS)

Customers are responsible for backing up (downloading) all Customer Data via the functionality provided within the SaaS service prior to the subscription termination date. Upon expiration or termination of a SaaS subscription, Insignary will delete all Customer Data within thirty (30) days, unless otherwise agreed in writing between the parties prior to termination.

Customers requiring data retention beyond the standard 30-day period, or requiring data migration assistance, may request an extended retention arrangement prior to the termination date. Such arrangements are subject to mutual written agreement and may be subject to additional fee.

During the term of the subscription, Customer Data is processed solely for the purpose of delivering the contracted services and is handled in accordance with Insignary's applicable data protection policies.

12. Customer responsibilities

The effective delivery of support services depends on the Customer's cooperation. Customers are expected to:

Provide sufficient detail when submitting tickets, including product version, deployment environment, steps to reproduce, and relevant logs or screenshots
Designate a primary technical contact responsible for coordinating support activities
Respond promptly to requests for additional information or clarification from Insignary support staff; unresponsive tickets may be placed on hold pending Customer reply
Cooperate in reproducing reported issues in a test or staging environment where possible
Apply available software and database updates in a timely manner, as unpatched environments may limit Insignary's ability to provide support
Notify Insignary promptly of any changes to the Customer's deployment environment that may be relevant to an open support issue

13. Feedback and continuous improvement

Insignary values input from customers and partners as a key driver of product and service quality. Customers are encouraged to submit product feedback, feature requests, and service improvement suggestions through the Insignary Service Desk or directly to their designated contact.

All feedback received is reviewed by Insignary's product and engineering teams and considered for inclusion in future product roadmap planning. While Insignary does not guarantee implementation of any specific suggestion, it is committed to transparent communication regarding the status of submitted feedback where practicable.

14. Exclusions

This SLA does not apply to issues arising from the following:

Customer modification of Clarity configuration outside of documented and supported parameters
Third-party infrastructure failures, including operating system, network, or container platform issues not within Insignary's control
Issues caused by third-party integrations or software not certified or supported by Insignary
Customer's failure to apply recommended software updates or database updates within a reasonable timeframe
Force majeure events, including but not limited to natural disasters, acts of war, cyberattacks on third-party infrastructure, and government-mandated actions
Versions of Clarity that have reached End-of-Life (EOL) status
Issues resulting from use of the software in a manner inconsistent with Insignary's documentation or the applicable Order Form

15. Review and amendments

This SLA is reviewed annually or upon mutual agreement between the parties. Insignary reserves the right to update the terms of this SLA with a minimum of 60 days' prior written notice to the Customer or Authorized Partner. Any amendments to this SLA must be made in writing and agreed upon by duly authorized representatives of both parties.

In the event of a conflict between this SLA and the terms of an applicable Order Form or license agreement, the terms of the Order Form or license agreement shall prevail unless otherwise expressly stated.