Service Level Agreement (SLA)
Last updated: 4 June 2026
This is an English translation of the Dutch “Service Level Agreement”. Only the Dutch version is legally binding; if the two differ, the Dutch version prevails.
This SLA describes the availability and support arrangements for the Exposentry service and forms part of the agreement between Hasecon and the Customer. Terms have the meaning given to them in the Terms and Conditions.
1. Availability per subscription
| Subscription | Availability target (monthly) | Type of commitment |
|---|---|---|
| Baseline scan | No guarantee | Best effort |
| Ketenpartner | 99.5% | Best-efforts obligation (inspanningsverplichting) |
| NIS2 Monitoring | 99.9% | With service credits (Article 5) |
| NIS2 + Supply Chain | 99.9% | With service credits (Article 5) |
"Availability" refers to the accessibility of the Exposentry platform (dashboard and API), measured per calendar month using the formula: (total minutes in the month − minutes unavailable) / total minutes in the month × 100%. Minutes that do not count under Article 2 are removed from both the numerator and the denominator. Unavailability is determined on the basis of Hasecon's monitoring as shown on the status page.
2. Service window, maintenance and backup
2.1 Fixed maintenance window
Hasecon uses a fixed weekly maintenance window on Monday from 22:00 to 23:00 (CET/CEST). Maintenance within this window is deemed to have been announced and does not count as downtime.
2.2 Daily backup
A backup takes place daily at around 05:00 (CET/CEST), during which the Service may be wholly or partly unavailable for a maximum of 30 minutes. This period does not count as downtime.
2.3 Additional planned maintenance
Hasecon announces additional planned maintenance outside the fixed window at least 48 hours in advance via the status page or by email, and carries it out outside office hours as far as possible. This additional maintenance amounts to no more than 4 hours per calendar month and, provided it is announced in time and stays within this maximum, does not count as downtime.
2.4 Emergency maintenance and hotfixes
In the event of an acute security threat or a critical outage, Hasecon may intervene immediately. Hasecon announces emergency maintenance in advance as far as possible and aims for at least 4 hours' notice; if this is not possible because of the nature or urgency of the threat, Hasecon may intervene without prior notice and informs the Customer as soon as possible afterwards via the status page. Emergency maintenance does not count as downtime.
2.5 Other exclusions
In addition, the following do not count in the calculation of availability:
- Force majeure (overmacht) as described in the Terms and Conditions, including disruptions at sub-processors (Mollie, email provider, authentication service, hosting provider) and in the upstream open-source OpenKAT components.
- Unavailability caused by the Customer or by factors outside the platform (such as the target systems to be scanned or the Customer's network).
- Unavailability of the scanning functionality as a result of a defect in OpenKAT (see Article 4).
- Suspension for non-payment or breach of the AUP.
3. Scope: platform versus scanning functionality
This SLA distinguishes between two things:
- Platform availability (Article 1): the accessibility of the dashboard and API. Hasecon manages this itself, and the availability target set out in Article 1 applies to it.
- Scanning functionality (Article 4): actually running scans and delivering reports. This functionality partly depends on the upstream open-source OpenKAT components and is subject to a different, lighter regime.
4. Scanning functionality and defects in OpenKAT
4.1 Nature
The scanning functionality is provided on the basis of a best-efforts obligation. Hasecon does not guarantee a fixed lead time for the delivery of a Report, nor a guaranteed availability percentage for the scanning pipeline. Hasecon aims to keep the scanning pipeline operational as much as possible and publishes known disruptions on the status page.
4.2 Distinguishing between causes
In the event of a disruption to the scanning functionality, Hasecon determines in good faith where the cause lies:
- In Hasecon's platform or its own scan orchestration: Hasecon endeavours to resolve this as a priority.
- In the upstream OpenKAT components (a defect or bug in the open-source software): see Article 4.3.
On request, Hasecon explains the categorisation it has made, and makes disruptions known via the status page.
4.3 Defects in OpenKAT (upstream)
OpenKAT is open-source software developed by a community. Hasecon is one of the code owners (mede-code-owner), but has no unilateral control over the roadmap, the prioritisation or the resolution time of the OpenKAT community. Therefore, for a defect whose cause lies in OpenKAT itself:
- It is not a failure under this SLA and does not count in the availability measurement of Article 1.
- It gives no entitlement to service credits (Article 5).
- Hasecon commits to no resolution time.
In that case, Hasecon does commit to the following efforts:
- investigating and diagnosing the reported problem within a reasonable period;
- where possible, finding and applying a temporary workaround or mitigation;
- escalating the problem to the OpenKAT project as a contributor and, where possible, following its progress;
- informing the Customer of the status via the status page.
4.4 Relationship to detection quality
As provided in the Terms and Conditions, Hasecon does not guarantee that all vulnerabilities will be detected. The absence or inaccuracy of a detection as a result of a characteristic or defect of OpenKAT falls under this article and not under the availability target of Article 1.
5. Service credits (NIS2 Monitoring and NIS2 + Supply Chain only)
If the platform availability target of 99.9% (Article 1) is not met in a calendar month, a customer with NIS2 Monitoring or NIS2 + Supply Chain may claim a service credit. Disruptions that do not count under Article 2 or Article 4 give no entitlement to credits.
| Actual monthly availability | Service credit |
|---|---|
| 99.0% – 99.9% | 10% of the monthly value |
| 95.0% – 99.0% | 25% of the monthly value |
| < 95.0% | 50% of the monthly value |
At the Customer's request, service credits are set off against a subsequent invoice, provided they are requested within 30 days after the month concerned. Service credits are the sole and exclusive compensation for failing to meet the availability target and are not paid out in money. The total credits per month never exceed 50% of the monthly value of the subscription.
6. Support
| Subscription | Channel | Response target (first response) |
|---|---|---|
| Ketenpartner | 2 working days | |
| NIS2 Monitoring | Email (priority) and direct escalation for critical findings | 1 working day |
| NIS2 + Supply Chain | Email (priority) and direct escalation for critical findings | 4 office hours |
Office hours are working days from 09:00 to 17:00 (CET/CEST), excluding public holidays. Response targets refer to the first response, not the resolution time.
7. Status page and incidents
Current availability and incidents are published on the status page. Hasecon endeavours to communicate major incidents in a timely and transparent manner.
8. Amendments
Hasecon may amend this SLA, subject to a notice period of at least 30 days by email. An amendment that materially lowers the agreed service levels gives the Customer the right to cancel the subscription with effect from the date on which it takes effect.