Axway Cloud Services Support Policy and... · 2019-07-19 · Business Continuity Business continuity aims to continue the Axway Managed Cloud Service with minimum possible disruption

Managed Cloud Services and SLA Description

May 10, 2019 Axway Cloud Services

© Axway, 2019 / Version: 7.0.0 / Status : Released / Ref.: 20190510-070000-CH

1/40

Axway Cloud Services

Axway Managed Cloud

Services and SLA Description

Version 7.0.0 of May 10, 2019

Status: Released




2/40

Document History

Version Date Update Origin Written by Verified by

6.0.2 13 Apr 2017 Update general terms Axway Axway

6.1.0 01 Dec 2018 Updated terminology Axway Axway

7.0.0 10 May 2019 Updated descriptions Axway Axway




3/40

Summary

1. Introduction 6

1.1. Overview 6

1.2. Reference Documents 6

1.3. Key Definitions 6

2. Overview Axway Managed Cloud model 9

2.1. Axway Managed Cloud Services Platform Model 9

2.2. Service Level Agreement (SLA) levels 9

2.3. Axway Managed Cloud Services layers 10

2.4. Managed Service levels 10

3. Axway Managed Cloud Service Description 11

3.1. Services included in the standard Managed Services levels 11

3.1.1. Platform Management 11

3.1.2. Dataflow Monitoring 12

3.1.3. Dataflow Management 13

3.2. Other activities included in the standard Axway Managed Cloud subscription 13

3.2.1. Initial Technical Setup (Build Phase) 13

3.2.2. Run Phase (subscription phase): 14

3.2.3. IaaS Hosting Partner for the Subscription Services 14

3.3. Managed Cloud Services – Infrastructure options 14

3.3.1. Choice of AWS Data Center 15

3.3.2. VPN Service 15

3.3.3. Certificate Service 15

3.3.4. Encryption of the Hosting Layer 15

3.4. Additional Implementation Services 16

3.5. Service Catalog 16

3.5.1. Service Catalog Introduction 16

3.5.2. Working period for Service Catalog Items 16

3.5.3. Fixed Price Service Catalog 17

3.5.4. T&M Service Catalog 18

3.5.5. Delivery of Multiple Items 18

3.5.6. Adding to the Service Catalog 19

3.5.7. Warranty Period 19

3.5.8. Purchasing options 19

3.6. Activity Outside Scope 19




4/40

3.7. Customer requested infrastructure and solution rules 20

4. Usage and reporting 21

4.1. Components of the Standard Axway Managed Cloud Service Offering 21

4.1.1. Level of usage of the solution and services 21

4.1.2. Subscription Term 21

4.1.3. Usage for production environments 21

4.1.4. Calculation of Excess Use (overage) 21

4.1.5. Usage for non-production environments 22

5. Organization and Functions in Axway Managed Cloud Services 23

5.1. Axway Managed Cloud Services Support Organization 23

5.1.1. Helpdesk: Support Level 0 23

5.1.2. Cloud Service Desk: Support Level 1 23

5.1.3. Cloud Operation Desk: Support Level 2 24

5.1.4. Cloud Solution Management: Support Level 3 24

5.2. Global organization 24

5.2.1. A global organization 24

5.2.2. Language and description of incidents, request and information 25

5.3. Axway Roles and Responsibilities 25

5.3.1. Customer Success Manager 25

5.3.2. Technical Operation 26

5.4. Governance 26

5.4.1. Steering committee 26

5.4.2. Status meeting (Optional service) 27

5.5. Axway Cloud Functions and Processes 27

5.5.1. Audits 27

5.5.2. Maintenance 27

5.5.3. Security Management 28

5.5.4. Software Platform Monitoring 29

5.5.5. Technical Infrastructure Management 29

5.5.6. Backup and Restore Management 29

5.5.7. Archiving Management 30

5.5.8. Capacity & Availability Management 30

5.5.9. Disaster Recovery (DR) 30

6. Standard Service Level Agreements Description 31

6.1. Incident Management 31

6.2. Summary of Services by SLA Level 31

6.3. SLA Exclusions 32

6.3.1. Incidents Originated by the Customer or Partners 32

6.4. Service Quality Indicator (SQI) 32




5/40

6.4.1. Incident Indicators 33

6.4.2. Service Indicator 35

7. Restrictions specific to certain analytical functions 38

7.1. Analyzes data from application users ("App Users") 38

7.2. Data related to the usage of the product 38

7.3. Customer Privacy Policy 38

7.4. USE OF AXWAY CLOUD SERVICES ("ACS"). 38

7.5. USE OF AXWAY PERFORMANCE MANAGEMENT SERVICES ("APMS") 39

7.5.1. Use 39

7.5.2. Data 39

7.5.3. Confidentiality 40




6/40

1. Introduction

1.1. Overview

This document describes the services delivered by Axway to its customers and the service levels offered

for Axway’s Managed Cloud Services offerings.

1.2. Reference Documents

Document reference Description

Order Form Describes the terms and conditions specific to each customer,

including the price of the services.

Subscription Schedule Describes the details and parameters of the provided services,

specific to each customer

Axway Subscription General

Terms and Conditions

Describes general terms and conditions of Axway Subscription

Services

Axway Support Policy and

Procedures

Describes the policy and procedures for handling of technical

inquiries.

Axway Cloud Security Statement Describes Axway Cloud security policy and best practices set

by Axway.

1.3. Key Definitions

Terms Definition

Build Phase The Build Phase starts on the Effective Date of the Agreement

and ends on the Subscription Commencement Date or at the

end of a related implementation project.

Unless otherwise defined in the Order Form, only non-

production environments are provided during the Build Phase.

The Build phase corresponds to the provision of non-production

environments to Axway Professional Service teams or to

Customer teams.

There is no Service Level commitment during this phase.

Subscription Commencement Date Unless otherwise defined in the Order Form, the Subscription

Commencement Date is the first day of the month in which the

platform for the first environment is available in the Axway

Cloud environment.

The Subscription Commencement Date is not linked to:

• deployment of configuration on the production platform,

• any activity or usage of the services deployed in production




7/40

Subscription Phase

(or Run Phase)

The Subscription Phase starts on the Subscription

Commencement Date and ends on termination of the

agreement.

Duration of the contract The duration of the contract starting from the signature date

and ending on termination of the agreement. The duration

includes the Build phase and the Subscription phase.

Cloud Operations Guide (COG) Document prepared jointly by Axway and the Client describing

the means and the organization to setup for operating the

Axway Managed Cloud Service in order to achieve agreed

service levels.

Support Availability Set business hours and on-call terms during which Axway

Managed Cloud Support is available to work on incident tickets.

Platform “Software Platform Management Services“ described in

chapter 2.3

Named Customer Contacts Resources identified in customer organization who:

• Have the ability to create tickets with Axway,

• are a point of contact to share and provide information for the resolution,

• can take action on behalf of Customer,

• have the ability to change and validate status of tickets

• have the ability to send requests for additional services or

order Service Catalogue Items

Response Time See definition in Axway Support Policy and Procedures.

Restore Service Time See definition in Axway Support Policy and Procedures.

Business Hours

(Used for SLA calculation)

These are the applicable business hours for the Response Time

and Restore Service Time measurements.

The specific hours and time zone are specified in the

Subscription Schedule in alignment with Customer’s business.

Business Hours for Service

Requests

Business hours during which service request activities for the

items listed in the additional Managed Services are conducted.

Business Continuity Business continuity aims to continue the Axway Managed Cloud

Service with minimum possible disruption and ensures the

availability of services and data regardless of the problems.

Disaster Recovery is a component of business continuity.

Disaster Recovery Ensures, in case of major crisis in the primary processing

location, the reconstruction of the solution and restoration of

services supporting the Customer’s activities in another

processing location.

Two (2) measurements commonly used in disaster recovery

are defined as:




8/40

• Recovery Time Objective (RTO): the maximum duration of

time within which platform availability must be restored

after a disaster.

• Recovery Point Objective (RPO): the maximum period in which data might be lost from the service.




9/40

2. Overview Axway Managed Cloud model

Axway Managed Cloud Services are provided as customer-dedicated cloud-based Managed Services

offering. The Managed Services per solution are providing defined functionality which are covered by a

selected Service Level Agreement (SLA) level.

The deployment architecture is well-defined per available SLA level, in order to satisfy the committed

availability. The Customer does not have any influence on the given deployment architecture. Axway

may change or enhance the architecture without notice or modification to the contract.

2.1. Axway Managed Cloud Services Platform Model

Axway Managed Cloud Services are provided per Customer as dedicated, single-tenant, Virtual Private

Cloud (VPC) deployment.

The technical environment is dedicated to the Customer and isolated from all other customers. Axway is

responsible for the technical architecture and its components.

All licenses and technical infrastructure are owned by Axway and are made available to the Customer in

a subscription model. The Customer has a right to use the services implemented and operated by Axway

in accordance with its commitments.

Axway leverages a centralized set of management tools for access control, service and security

monitoring, and maintenance.

2.2. Service Level Agreement (SLA) levels

The following diagram illustrates the different SLA levels.




10/40

2.3. Axway Managed Cloud Services layers

The Axway Managed Cloud Services are composed of the following layers:

• Hosting layer: Infrastructure and all technical elements (e.g., server, network, database,

operating system, middleware).

• Application layer: Axway software installed and running on the hosting layer, including Axway

monitoring, supervision and security management tools.

• Solution layer: Technical and business configuration of the solution according to the specific

business and operational requirements of the Customer.

• Traffic layer: Data that is dynamically processed by the Solution layer configuration and all

related runtime operations.

2.4. Managed Service levels

There are three (3) incremental levels of Managed Services allowing different levels of delegation from

the customer to Axway:

• Platform Management: Platform as Managed Service by Axway, customer responsible for

configuration, monitoring and management of all data flows and incidents on the solution and

traffic layer

• Dataflow Monitoring: Platform Management + Incident Monitoring provided by Axway, customer

responsible for data configuration and management of all data flows and incidents on the solution

and traffic layer

• Dataflow Management: fully Managed Service with full delegation to Axway for all 4 layers

Based on Customer’s needs for management and administration of the Services, Axway will propose one

of the three Managed Services levels. The selected level is specified in the Subscription Schedule.

Details about these Managed Service levels and other Services are described in the following chapter.




11/40

3. Axway Managed Cloud Service Description

This chapter describes

• The services included with standard Axway Managed Cloud subscriptions.

• Optional services offered with a subscription model.

• Additional services and Services catalog.

• Exclusions and limitations.

3.1. Services included in the standard Managed Services levels

Axway performs a set of standard tasks for all its customers on the four (4) layers of the cloud stack

(Traffic Layer, Solution Layer, Application Layer, Hosting Layer, defined above in 2.3), to ensure the

availability of the service and the quality of the related processes. Many of these tasks are accomplished

in the background and with no downtime for the service.

For further details about activities and responsibilities between Axway and Customer for the different

Managed Services levels please see also the separate document “Axway Managed Cloud - Activities and

Responsibilities”.

3.1.1. Platform Management

Axway is responsible in partnership with its hosting provider for all build, monitoring, and maintenance

operations for the equipment required as part of the service platform (Hosting + Application layer).

• Axway manages the underlying platform (infrastructure and application layer), covers all related

operations and administration tasks, and ensures the service is up and running (available).

• Customer remains responsible for the overall management of all configuration and data processing

on Solution and Traffic layer.

• Within the boundaries of the Axway product User Interfaces, the Customer keeps the full

responsibility (self-service) for all development, configuration (BUILD) and runtime data processing

(RUN) activities – meaning, all activities on Solution and Traffic layer.

• Customer can optionally buy configuration and implementation services via a well-defined Service

Catalog or as individual Project Service via a separate Statement of Work (SOW).

• Axway is responsible for monitoring and fixing of all issues on the Hosting and Application layer.

• For issues on the solution and traffic layer the Customer can raise support requests with Axway, for

assistance.

• Customer remains responsible for business and functional issues, as well as for communication

with its internal and external trading partners.

• Axway is responsible for all maintenance on Hosting and Application layer.

• Regarding application maintenance, Customer is responsible for all related validation and any

required adaptation on Solution and Traffic layer.

• Axway is responsible all support of Hosting and Application layer.




12/40

• Axway is responsible for 3rd level support for the Traffic and Solution layer, supporting the

customer.

• Error on the services or components developed, configured, modified or deployed by Customer:

Axway can only inform the Customer of the error. Axway does not have detailed knowledge of

these items and their context, therefore Axway is not able to take the appropriate steps and

engagement to solve this type of incident. In the case of services or components developed,

configured, modified or deployed by the Customer, Axway will be able to alert or detect errors only

if those services or components are configured to be detected by Axway’s monitoring tools.

3.1.2. Dataflow Monitoring

• Axway manages the underlying platform (infrastructure and application layer), covers all related

operations and administration tasks, and ensures the service is up and running (available).

• Customer remains responsible for the overall management of all configuration and data processing

on Solution and Traffic layer.

• Axway also monitors the Traffic layer and notifies the Customer proactively about any incidents.

Axway will not analyze the cause of the issue and not take any corrective actions.

• Within the boundaries of the Axway product User Interfaces, the Customer keeps the full

responsibility (self-service) for all development, configuration (BUILD) and runtime data processing

(RUN) activities – meaning, all activities on Solution and Traffic layer.

• Customer can optionally buy configuration and implementation services via a well-defined Service

Catalog or as individual project services.

• Axway is responsible for monitoring and fixing of all issues on the Hosting and Application layer.

• Axway is also monitoring the Traffic layer for issues and will proactively notify the Customer about

any incidents.

• For issues on the solution and traffic layer the Customer can raise support requests with Axway, for

assistance.



• Axway is responsible for all maintenance on Hosting and Application layer.

• Regarding application maintenance, Customer is responsible for all related validation and any

required adaptation on Solution and Traffic layer.

• Error on the services or components developed, configured, modified or deployed by Customer:

Axway can only inform the Customer of the error. Axway does not have detailed knowledge of

these items and their context, therefore Axway is not able to take the appropriate steps and

engagement to solve this type of incident. In the case of services or components developed,

configured, modified or deployed by the Customer, Axway will be able to alert or detect errors only

if those services or components are configured to be detected by Axway’s monitoring tools.




13/40

3.1.3. Dataflow Management

• Customer delegates the full management of the solution (configuration/BUILD and data

processing/RUN) to Axway.

• Axway is responsible for the Platform Management incl. all related operation and administration,

BUILD of the Solution layer and RUN operations of the Traffic layer, and the Customer cannot

access or modify them!

• The monthly subscription fee covers all Platform Management and RUN operations activities. BUILD

activities will be quoted and charged separately.

• Customer must request all BUILD activities, and esp. the initial implementation or transition project

from Axway, which will have to be defined in a separate Statement of Work (SOW).

• For ground-to-cloud transitions, existing configuration might be taken over. Axway Professional

Services will perform a configuration and code review, and perform required adaptations, as part of

a separate Statement-Of-Work.

• Customer can buy additional configuration and implementation services via a well-defined Service

Catalog or individual project services.

• Axway is responsible for monitoring, fixing, and escalation of all issues delegated to Axway

regarding Customer’s use of the services.



o Regarding functional or business errors Axway will inform the Customer of the error.

Axway does not have responsibility for addressing these items. Axway does not have

detailed knowledge of these items and their context, therefore Axway is not able to take

the appropriate steps to solve this type of incident.

3.2. Other activities included in the standard Axway Managed Cloud subscription

3.2.1. Initial Technical Setup (Build Phase)

The Axway Managed Cloud Service includes set up of the Customer’s environment and integration into

the Axway cloud platform. The setup tasks vary based on Cloud Managed Services level and Cloud

Platform Model and on the selected SLA. They may include:

• Architecture and provisioning for each environment

o Hosting layer

o Application Layer

• Network configuration

• Security setup

• Backup and snapshot configuration

• Integration of Customer environment into Axway Global Cloud environment

o Technical configuration of monitoring tools

o CMDB configuration

o Documentation setup




14/40

o Cloud team setup and organization

3.2.2. Run Phase (subscription phase):

In any case, Axway performs the following tasks and activities during the Run Phase on hosting and

application layer:

• monitoring systems and control processes for availability of services

• manage technical incidents and problems

• manage backup and restore

• manage network and system access

• reporting tools

• capacity management

• release management

• change request management

• for the production environment

o standard reporting for SLAs and billing

o optional Disaster Recovery (DR) service: one (1) DR test per year, if applicable

3.2.3. IaaS Hosting Partner for the Subscription Services

a. IaaS hosting partner

Axway operates the Subscription Services on the Amazon Web Services (AWS) hosting platforms. This

operator guarantees both safety and availability necessary to meet the requirements agreed between

the parties. Additional information on this partner are available on request.

b. Geographical positioning data

Axway selects the Datacenter and architecture level for the "Software Platform Management Level". The

Subscription Services and data hosting will be performed from the European Datacenter Amazon AWS

chosen by Axway.

The default AWS Datacenter used by Axway are listed in the Subscription Schedule.

Optionally and on Customer’s request specified in the Subscription Schedule, the Subscription Services

and data hosting may be performed from another AWS datacenter.

3.3. Managed Cloud Services – Infrastructure options

In addition to the standard Subscription Services of the Cloud Offering Models described in chapter 2

above, Customer can customize the Services with optional Subscription Services. The optional

Subscription Services subscribed by the Customer will be specified and detailed in the Subscription

Schedule.




15/40

3.3.1. Choice of AWS Data Center

The Axway Managed Cloud Service is configured in a single AWS Region in one of the default regions, or

as specified in the Subscription Schedule.

Optionally and on Customer’s request, the Subscription Services and data hosting may be performed in

any of the AWS regions.

3.3.2. VPN Service

Axway can provide optional dual VPN tunnels to connect the Customer network to the Axway Managed

Cloud Service. This service includes monitoring of the VPN link to detect issues on the line.

Axway is responsible for the connection point to the Axway infrastructure (SLA). Axway is not

responsible:

• For the customer or partner connection point.

• Availability of the network (internet / extranet) between the customer / partner and Axway.

The technical setup is limited to the configuration of the VPN on the Axway side.

The customer is responsible for the configuration of the VPN link in its IT infrastructure.

The VPN connection is made over the Internet.

3.3.3. Certificate Service

In the event the Customer or one of its partners requests the usage of an SSL certificate from a certificate

authority (CA), Axway may provide one or more certified certificates to the Customer for the exclusive

use of the Cloud Axway services. The default offering is to provide self-signed certificates.

Certificates provide by Axway are the exclusive property of Axway.

Unless explicitly requested by the Customer three months in advance, the certificates are automatically

renewed per the duration or period of validity until the end of the contract.

3.3.4. Encryption of the Hosting Layer

Depending on Customer’s security constraints, it is possible to encrypt the Hosting Layer. Axway uses

services offered by AWS to perform encryption. Axway manages the keys which are stored in a secure

place at AWS. Axway recommends that all data in motion be restricted to secure protocols. Any

exceptions to this must be approved in writing.

Encryption of the Hosting Layer as well as the keys are managed based on the services provided by

AWS. Encryption only covers Axway’s Virtual Private Cloud (VPC) and the data in Axway’s VPC and does

not cover:

• Environment external to AWS or Axway.

• AWS network between the internet and the Axway VPC

For further details on the EBS Encryption option, please refer to AWS’ documentation available at:

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-ug.pdf (chapter titled Amazon EBS

Encryption)




16/40

3.4. Additional Implementation Services

The scope of Additional Professional Services for the Service Management Level is highly adaptable to

the needs of the Customer.

Business or Functional Configuration and Migration Project

Once the technical environment is available (during Build Phase), the functional configuration and

migration project is executed as a separate project, detailed either in a separate professional services

contract or statement of work, or described in the Cloud Services Subscription Schedule.

3.5. Service Catalog

3.5.1. Service Catalog Introduction

Axway Managed Cloud Services offers standard items to enhance the solution such as adding or

modifying data flows. Service Catalog items associated with the solution are not included in the Managed

Cloud subscription fees. The Customer authorizes specific personnel to order from the Service Catalog.

The list of personnel authorized to order from the Service Catalog is specified in the Quality Assurance

Plan.

Axway reserves the right to revise the prices of various items on an annual basis to take into account

the actual expenses incurred.

3.5.2. Working period for Service Catalog Items

The requests for Service Catalog items will be processed during business hours. Business hours are

Monday – Friday, 8 AM To 5 PM, with exception of local bank holidays, for the Axway Cloud location

operating the Service or as specified in the Order Form. The time zone is specified in the Order Form.

Extended service hours will result in additional fees and will be specified in the Order Form.

• In case of a Customer request which Axway must perform outside business hours (except

production deployment activities) a premium of:

o 50% during the week (Monday to Friday),

o 100% for weekends (Saturday and Sunday) and holidays,

o will be applied to the service items ordered.

• If Customer requires rushed delivery, a premium of:

o 30% to reduce the duration of delivery by 20% or less

o 60% to reduce the delivery time by over 20%

o 100% to begin development no later than next business day.

Axway may not be able to perform these requests outside of business hours or on a rushed delivery

schedule and will inform Customer of such constraints.




17/40

3.5.3. Fixed Price Service Catalog

The service items defined in this Services Catalog:

• Correspond to a standard development or operational task

• Fees are applied at a flat rate

a. Definitions

Terms Definition

Validation Time Maximum duration for Axway to:

• validate documents provided by the Customer,

• validate the completeness of documents

delivered by Customer,

The Validation period starts:

• After validation by the Customer of the

commercial proposal of items ordered.

• Customer has provided all necessary documents for development. This validation

also validates the adequacy of the proposed services with the documents provided

Development Time Maximum duration for Axway to provide the items ordered in

Test or (optionally) Pre-production environment for the

Customer to test and validate the service items delivered.

The development starts after validation by Axway of delivered

documents.

b. Tasks included in the fixed price Service Catalogue

Development related activities carried out by Axway:

• Understanding specifications provided by the client

• Development articles based on specifications

• Unit tests only based on test data provided by the customer.

Axway does not develop test data because Axway does not have complete and specific knowledge of the

customer business or context and cannot ensure the relevance of Axway test data.

• Deploy in test environment for validation by the client and/or partners.

• Support to the client during testing

• Fix issues - Any issues

requiring development or change of specifications may be charged to the customer

• Preparation of Axway Change Request for production deployment

• Deployment to production.




18/40

c. Tasks and activities excluded in the fixed price Service Catalog

By default, unless specifically described in the Order Form, the following tasks or activities are excluded:

• Interaction with users or customer partners to define specifications

• Write specifications for the customer

• Create test cases/plan

• Validation on behalf of customer for production deployment

• Coordination with users and customer partners for acceptance testing and deployment.

3.5.4. T&M Service Catalog

The purpose of the T&M Service Catalog is to provide relevant expertise to address the following services:

• Assistance and consulting related to the subscribed services

• Help in problem solving

The service catalog cannot be used in the following cases:

• Provision of a consultant (means of engagement, full or part) for services not related to the order

form,

• Services provided by Axway Training and skills transfer.

• Development of items available at the Fixed price Service Catalog

These Services items are billed based on time spent either in local currency or in Service Unit Points.

Consultant profiles are:

Profile Description

Cloud Consultant Performs all service work, system integration, installation,

specification. Participates in the development and

implementations from simple to complex solutions or services

Cloud Architect Expert in architecture, design and audit

Cloud Principal Expert in technical and/or business domain. Conducts audits and

implementation and consulting services

Cloud Delivery Manager Project management. Ensures the proper performance of the

services within the contractual framework defined with the

customer

3.5.5. Delivery of Multiple Items

If the Customer orders several service items from the service catalog, Axway reserves the right to

coordinate a delivery schedule based on business priorities and workload instead of the specified

development times. Axway and Customer will validate the delivery schedule.




19/40

3.5.6. Adding to the Service Catalog

In case of new requirements not covered by the service catalog, Axway will prepare a proposal of services

that cover the necessary work to implement the service. In cases where this need would be repetitive,

Axway may incorporate this service into the service catalog.

3.5.7. Warranty Period

All service items delivered will be covered by a warranty period of 30 calendar days from the date of

delivery or production deployment. During this warranty period, in order to validate the quality of

development and the initial specifications, no SLA will be applicable and enforceable if the new services

cause these incidents or errors. This period will begin when data is processed using the newly deployed

solution to validate and verify compliance of this item.

The warranty period does not cover changes to the items delivered after the initial deployment.

3.5.8. Purchasing options

Axway offers two options to purchase the services listed in the Service Catalog:

• Order items from the service catalog on-demand. Fees are defined as "Purchase on demand".

o Billing of items ordered occurs at the end of the month

• Pre-pay for a pack of Service Units and use it during the subscription term.

o Each item is assigned a number of Service Unit points

o Each item ordered is deducted from the purchased pack of points

o All SU points not consumed at the end of the contract year are automatically carried

forward to the new year

o If the customer has consumed all SU points, additional SU points may be purchased.

o SU points remaining at the end of the contract are not eligible for refund.

3.6. Activity Outside Scope

List of activity outside the standard Axway scope

• Customer’s client or customer's partner: the customer will retain full responsibility for the

relationship with clients, vendors, and partners that interact with the Axway Cloud solution.

• Business management: the customer will retain full responsibility for the management and

resolution of business issues passing through the Axway solution.

• Licenses purchased by customer: Licenses owned and operated by the customer or another

vendor are not in the scope of the Cloud Agreement. They are governed by the license and

maintenance agreement between the customer and Axway and the Axway support policies located

at https://support.axway.com




20/40

3.7. Customer requested infrastructure and solution rules

The customer (or Axway on request by the customer) may set up rules to block or reject certain

exchanges (for example: quota violation, security rules, or anti-virus). The rejection or blocking of an

exchange by such a rule becomes “normal behavior” of the solution and will not be considered as an

error. Consequently, the Axway Managed Cloud solution and support team will not manage specific alerts

or creation of tickets for those rejections and blockings. The rejection or blocking of the exchange will

only be visible through the logs provided by the cloud solution.

In the event that the Customer would like to be informed or to have additional information on these

rejections or blocking, Axway may provide:

• Additional services to enhance the cloud solution to retrieve information and create specific alerts.

Axway reserves the right to refuse or suggest alternatives to requests for changes if they are

incompatible with the standard cloud service or with cloud security rules.




21/40

4. Usage and reporting

4.1. Components of the Standard Axway Managed Cloud Service Offering

4.1.1. Level of usage of the solution and services

When the Axway Cloud Subscription Service provides a tiered pricing structure based on use, then Axway

will provide monthly and quarterly reports showing the usage KPIs which define the tiers.

4.1.2. Subscription Term

This subscription term begins either when the first environment is delivered or at the end of the build

phase, depending on the approach specified in the Order Form. The total contract will include the

following phases:

a. Build Phase

The build phase is defined as the time from contract signing until the production environment is available.

There is no SLA commitment or penalty during the build phase. Some Axway Managed Cloud Service

Offerings are deployed very quickly and will not have a build phase. In this case the subscription phase

starts on the contract signature date.

b. Run Phase

The run phase begins when the production environment is available, even if there is no data being

processed. Any contracted Managed Services begin with the start of the Run Phase.

The invoice subscription terms are specified in the Order form

4.1.3. Usage for production environments

The regular usage and selected sizing tier for the Production environment(s) is specified in the

Subscription Schedule.

The usage for the Production environment is technically not limited. For usage beyond the subscribed

usage level (Excess Use), additional fees will be charged as defined in the Subscription Schedule (see

also below – Calculation of Excess Use).

The supported peak load per hour for Production environments is limited to 1% of the supported monthly

load of the selected sizing tier.

4.1.4. Calculation of Excess Use (overage)

Overage is calculated as follows:

• Note the usage of each main criteria and compare the value of the subscription tier chosen,

• Compute any overage related to these criteria for the subscription tier.




22/40

• Compute the additional fees for the overage for the month as defined in the Subscription Schedule.

• Invoice terms are specified in the Order Form.

4.1.5. Usage for non-production environments

For non-production environments included in the subscription, Axway is providing single-node

deployments with a processing capacity and expected usage at 20% of the production capacity and

usage specified in the Subscription Schedule.

Optionally available Pre-Production environments are sized at the same level as Production.

In the event of an overage, Axway will charge the overage at the rate set in the subscription based on

the subscription tiers.

Non-production environments may not be used to process production data.

The storage period is limited to the default period defined in the Subscription Schedule.

Service commitments are not applicable on non-production environments.




23/40

5. Organization and Functions in Axway Managed Cloud

Services

Axway organization and process are based on ITIL best practice and recommendation.

All Axway Cloud team members are certified on ITIL V3.

5.1. Axway Managed Cloud Services Support Organization

The diagram above summarizes the interactions between the different levels of support. Contact

information is provided in the QAP document delivered during the build phase of the project. Customers

with a Managed Services subscription will be provided with direct contact information to their support

team.

Two types of requests may be transmitted to Axway:

• Requests for change, configuration modification, or for information on the Cloud solution

• Incidents, which are recorded and supported globally by Axway in compliance with contractual

commitments

5.1.1. Helpdesk: Support Level 0

Calls to support start at Axway’s Global Support Center, where the call is prioritized and routed to the

Cloud Service Desk (Level 1). Customers may also submit incident and request tickets to Axway Cloud

via e-mail or the Axway web portal. Phone numbers for the Helpdesk can be found at:

https://support.axway.com/en/auth/contacts.

5.1.2. Cloud Service Desk: Support Level 1

The Cloud Service Desk has responsibility for ongoing monitoring of all production environments and

proactively addressing all alerts. This team also receives all incoming tickets. For routine responses,




24/40

Level 1 addresses and resolves the ticket. Otherwise, Level 1 will identify the appropriate Level 2 team

and hand-off the ticket.

5.1.3. Cloud Operation Desk: Support Level 2

If the incident cannot be resolved by Level 1, this team identifies the exact source of the error and

implements the measures and necessary actions to restore the service as soon as possible. It ensures

the resolution of the incident and the management of problems when incidents are reclassified as

problems. Level 2 will engage or escalate to Level 3 when additional expertise is necessary.

This team implements standard service items defined in the service catalog.

5.1.4. Cloud Solution Management: Support Level 3

If an incident cannot be resolved by Level 2, it is escalated to Level 3 where the ticket is addressed by

solution expert teams within Axway. Level 3 includes experts in administration, tuning, design,

architecture and hosting of the solution.

Level 3 Support is responsible for coordinating with third party providers (internal or external such as

Amazon Web Services and Axway R&D) on behalf of the customer. In all cases, Level 1 Support will

coordinate with the Level 3 Support team on behalf of the customer and provide regular and timely

updates to the customer.

5.2. Global organization

5.2.1. A global organization

The Axway cloud organization is a global organization with cloud centers around the world (US, France,

Germany, Bulgaria, Romania, and India):

• providing 24 x 7 support

• pooling activities and expertise to ensure service levels are met

• local representatives to work with our customers.

The organization includes:

• A front office team located in France, Germany, or US consisting of the Delivery Manager and

senior Cloud experts,

• The Axway Service Desk is based in the United States.




25/40

The organization described above is defined at date of signature of the proposal or the contract and may

change. It is given as an indication to the Customer and Axway reserves the right to revise this

organization without impact to the services provided or change to the contract.

The Customer acknowledges that all these teams can intervene to:

• Maintain operational services

• Restore Services

• Perform changes to the services

5.2.2. Language and description of incidents, request and information

As the Axway cloud organization is a global organization all written and oral exchanges or correspondence

should be in English to ensure optimal understanding, responsiveness and quality of resolution.

5.3. Axway Roles and Responsibilities

5.3.1. Customer Success Manager

The Customer Success Manager is accountable for delivery quality and the customer relationship:

• Verify that Axway meets its commitments to the Customer

• Oversee the Cloud Services being delivered to the Customer including incidents, requests, and

monitoring of the solution

• Deliver standard reports

• Organize steering committee meetings

• Address Customer requests for new services and changes to the existing services

The Delivery Manager on behalf and under the control of Head of Axway Cloud Department.

It is the global main point of contact with the customer but he can be helped by Run Manager or Build

Manager working under his authority.




26/40

5.3.2. Technical Operation

The Technical Operations teams ensures the delivery of the subscribed services. These teams provide

• 3 levels of support: Service, Operation, Solution.

As part of the Managed Service, Axway will create and maintain the following deliverables:

• QAP

• Project Log (working document for regular status meetings)

• Monthly KPI Report

These teams are managed by the Run Manager and Build Manager under direction of the Customer

Success Manager. These managers are located in the Axway Cloud centers and may be in a different

region.

a. Run Manager

• Ensure incidents are properly managed based on commitments

• Manages verification and promotion of changes into production

• Interacts with customers about incidents, changes, and problems

• First escalation point

b. Build Manager

• Manages requests through the service catalog.

• Validates and promotes newly developed changes into production in coordination with the Run

Manager.

• Validates updates and patches to the Axway applications.

• Interacts with customers for all requests.

5.4. Governance

5.4.1. Steering committee

The Axway Managed Cloud Service includes a standard steering committee meeting on a regular schedule

which depends on the selected services and SLAs. In this meeting the following points will be discussed:

• Review KPIs since last steering committee

• New requirements since last steering committee

• Customer satisfaction since last steering committee

• Invoicing and payments

• Delivery of reporting documents

In cases when the parties decide to cancel a steering committee meeting, the Customer will receive the

reporting documents.




27/40

a. Frequency

The standard schedule for steering committee meetings is

• quarterly for customers with Platinum and Gold SLA service levels

• and semi-annually for customers with the Silver SLA service level.

The meeting frequency is subject to project requirements as specified in the Subscription Schedule. As

an option a monthly steering committee can be subscribed by customer.

5.4.2. Status meeting (Optional service)

The status meeting is mainly applicable when Axway is performing Managed Services.

The status meeting facilitates the management of incidents, changes, and requests between the client

and Axway. Frequency of these meetings is specified in the Subscription Schedule.

5.5. Axway Cloud Functions and Processes

5.5.1. Audits

Axway contracts with a 3rd party to perform industry standard IT security and process audits such as

SSAE16 SOC1 and ISO 27001. The audits encompass the overall Axway Managed Cloud Service as well

as an examination of controls and evidence for customer environments. Axway will provide copies of the

certifications upon request. Further, Axway agrees to allow Cloud customers to perform an audit of the

Axway Managed Cloud Service and their own environment up to once per year at customer expense. All

further audit requests will be charged to the Customer on a time and materials basis.

5.5.2. Maintenance

In order to maintain the integrity of the Axway Cloud Service, regular maintenance activities must be

performed. Maintenance periods are excluded from all SLA calculations. Axway will use reasonable efforts

to perform maintenance outside of processing peak hours and minimize impact to customers.

• For Production environments: Customers will be informed of the preventive maintenance

scheduled, on the production environment, at least two (2) week in advance. Where possible, the

service changes that require downtime will be undertaken during periods of maintenance. A regular

maintenance window of maximum 4 hours / month will be coordinated by the Customer and Axway

before production go-live.

• For non-production environments Axway performs maintenance according to the Axway Cloud

schedule.




28/40

5.5.3. Security Management

a. Security Management

Axway maintains a strong security posture in order to proactively maintain and protect the Cloud Service.

The security rules and policies are described in the “Axway Cloud Security Statement".

In addition, Axway continuously monitors and evaluates each of our vendors and partners to assure that

they maintain the quality and certifications required to mitigate potential risks related to the security of

the platform and its physical environment.

The Customer understands their security requirements and the Axway security posture and declares that

the Axway service meets the needs for internal security constraints with respect to commitments with

third parties.

Certified SOC 1/SSAE16 (SOC 2 for 2017)

Certified ISO9001

Certified ISO27001

Axway Cloud resources are certified on ITIL Foundations V3.

SOC 1/SSAE 16/ISAE 3402 (SAS 70 Type II)

SOC 2

FISMA, DIACAP, FedRAMP

PCI-DSS Level 1

ISO27001/02, ISO 27018

ITAR

FIPS 140‐2

https://aws.amazon.com/security/

https://aws.amazon.com/fr/compliance/pci-dss-

level-1-faqs/

b. Data Privacy policy

Axway will not use the data entrusted by Customer in any way except as required to deliver the service.

However, in the course of support, Axway or its partners may need to analyze customer data to validate

syntax. In this context, Customer allows Axway and its partners to carry out these analyses. Axway will

not, in any cases, modify the data or content unless expressly requested by Customer.

At the end of the Subscription Term, Axway will return the data belonging to the Customer and destroy

any copies it may still have.




29/40

5.5.4. Software Platform Monitoring

Comprehensive monitoring of the platform is comprised of both automated monitoring and manual

monitoring.

a. Automated Monitoring

Business Activity Monitoring of key processes assures the achievement of SLAs. Moreover, the

appearance of bottleneck situations can be identified and addressed before they impact the service. As

part of the Axway continuous process improvement strategy, automated routines for monitoring are

being continually enhanced. Axway employs alerting mechanisms to ensure that errors are addressed

promptly.

b. Manual Monitoring

Automated monitoring will be verified by manual inspections of the application and regular inspection of

the solution according to Axway operations checklists.

The contents of these lists are based on

• the Cloud Business model

• the customer activity topology

The contents of these lists are updated based on

• changes and new services

• new releases of any component of the service

Any event detected by proactive monitoring triggers creation of a ticket and the incident management

process.

5.5.5. Technical Infrastructure Management

The Axway Managed Cloud Service includes full infrastructure management although facilities and some

operations may be provided by the Axway hosting partner.

As part of the delivery of services, Axway reserves the right to change its service delivery partners. If

this occurs, Axway will inform the customer and coordinate the transition.

5.5.6. Backup and Restore Management

Backup management is the responsibility of the Axway teams, although certain aspects may be

performed by the hosting partner. The backup plan will be issued during the initial project.

The management of:

• Backups and snapshots

• Restore

• Data integrity

Are performed by Axway using the service provided by our hosting partner (IaaS provider). These tasks

are performed automatically. Axway maintains full responsibility for all backup and restore actions.




30/40

All backups are stored in an encrypted state.

Database is replicated real-time in Multiple Availability Zones for faster Recovery in case of site failures.

5.5.7. Archiving Management

Archived data and storage is designed to retain data for a specified period of time. Depending on the

requirements specified in the Subscription Schedule, data may be stored online or offline using resilient

storage provided by the hosting partner. Once the archive period is over the data is automatically

destroyed.

5.5.8. Capacity & Availability Management

Axway tracks a number of technical and business measures using standard monitoring tools, in order to

correlate:

• The usage of services over time

• The consumption of technical resources over time

Axway will adjust the capacity of the service to meet customer use.

The subscription price is based on use and the subscription tier. These subscription tiers take into account

the capacity adjustment required to maintain the service.

5.5.9. Disaster Recovery (DR)

Based on contract terms, customers with an optional Disaster Recovery (DR) service will have a separate

DR environment for their solution. This service is intended only in the case of a major disaster and cannot

be treated as a backup solution (backup services are addressed by Availability Management).

Customers opting in for DR services will participate in development of a separate document entitled

"Disaster Recovery Plan" in collaboration with Axway teams.

Declaration of a disaster is the sole responsibility of the Axway Cloud management team.

As standard, the features of DR are as follows. They may be modified if requested by the customer.

These changes will be subject to a financial assessment.

Description Objective

DR test frequency 1 test/year

Recovery Time Objective (RTO) Depends on the SLA

Recovery Point Objective (RPO) Depends on the SLA

Customers with no DR option in their contract and those in the Public Cloud model will be subject to best

efforts to restore the service in case of a major disaster.

If Axway cannot successfully complete the DR test within the SLA indicator, Axway will analyze the root

cause and perform another test within 60 days after the first test.




31/40

6. Standard Service Level Agreements Description

6.1. Incident Management

The Axway Cloud incident management process follows the policies defined in Axway Global Support

Policy and Procedures.

6.2. Summary of Services by SLA Level

The table below provides a summary of the services associated with each SLA level.

Feature PLATINUM GOLD SILVER

Method to report tickets Phone / Web / Email

Class 1 tickets must be reported by phone(1)

Support Availability 24 / 7

Platform Availability (2) (3) 24/7 – 99.99% 24/7 – 99.9% 24/7 – 99.5%

Ticket Service SLA (3)

Class 1 – Critical

Class 2 – Urgent

Class 3 – Important

Class 4 – Minor/Info

MTTRespond

15 minutes

15 minutes

1 business day

1 business day

MTTRestore

4 hours

8 hours

2 business days

5 business days

MTTRespond

30 minutes

30 minutes

1 business day

1 business day

MTTRestore

6 hours

10 hours

2 business days

5 business days

MTTRespond

1 hour

4 hours

1 business day

2 business day

MTTRestore

1 business day

2 business days

6 business days

10 business days

Business Hour/day (4)

(considered for MTT SLA

calculations)

Monday to Friday

07h00 to 18h00

With exception of

local bank holidays

Monday to Friday

08h00 to 18h00

With exception of

local bank holidays

Monday to Friday

08h00 to 17h00

With exception of

local bank holidays

Time Zone (5) Default: Europe (CET/CEST) or US (MST)

DR (6)

RTO (Recovery Time Objective)

RPO (Recovery Point Objective)

Optional

4 hours

4 hours

Optional

8 hours

8 hours

Optional

24 hours

24 hours

Included environments

(Default)

1x Production

2x Development/Test

1x Production

2x Development/Test

1x Production

1x Development/Test

(1) Any Priority 1 ticket created via the web portal or email without a corresponding phone call will

automatically be reclassified as a Priority 2 ticket.

(2) Platform availability is application and guaranteed for Production environments only.

(3) SLAs and Platform availability are measured and calculated per calendar month, and exclude planned

maintenance.

(4) Business hours/day are based on the assigned Axway Managed Cloud Service and Support location.

(5) Time Zone is defined based on the core activity of the Axway Managed Cloud Service center. In the

event of a change of primary customer contact in a different Time Zone or change of the Time Zone for

the main activity Axway may adjust the rate of all services subscribed by the Customer

(6) DR is available as optional service.




32/40

6.3. SLA Exclusions

Axway’s failure to meet any service level agreement will be excused to the extent the failure is due to

• Force majeure.

• The acts or omissions of the Customer or its agents:

o Do not provide reasonable necessary information.

o Do not perform tests requested by Axway.

o Or any period during which access to the Customer environment has been denied to

Axway.

• Suspension or termination of the service.

• Due to improper use of the service by customer or their partners

• Service modified, updated or developed by the Customers.

6.3.1. Incidents Originated by the Customer or Partners

In case an incident is caused by improper use by the Customer, a third party working on behalf of the

Customer, or Customer’s end-users, and following customer request, Axway Managed Cloud Services

will perform the necessary work to restore the Service. This extra work shall be charged to the Customer

as Additional Services. Resolution of incidents originated by or on behalf of the Customer or Customer’s

end users includes, for example, network problems on the Customer’s side, configuration changes

performed by the Customer, and poor data quality in files which cause unwanted side effects. The time

spent will be invoiced based on the rate cards and fees defined in the Subscription Schedule.

6.4. Service Quality Indicator (SQI)

Below is the methodology for calculation of the Service Quality Indicators as well as the frequencies of

these indicators used by Axway.

The Service Quality Indicators are split into different categories:

• Key Incident Indicator: indicator evaluates the level of service delivered

• Key Service Indicator: indicator measuring the performance of the service

• Key Informative and Performance Indicator: used as complementary information

It is possible to add new indicators if the provided SQI does meet the customer need.




33/40

6.4.1. Incident Indicators

a. MTTRespond

DEFINITION

Quality indicator topology Key Incident Indicator

Quality indicator definition

The average Response Time for all tickets of a specific priority for the

measurement period. The SLA sets Axway’s MTTRespond commitment.

The KPI value represents the maximum average mean time acceptable per

Priority. The MTTRespond indicator will be presented as a percentage to the

customer.

• The incident respond time is calculated between time of automatic detection

or reporting of the incident and the time where incident is no longer in

"Opened" status.

• MTTRespond value equal to or below 100% shows the SLA has been met.

• MTTRespond value over 100% shows Axway did not meet this SLA.

Axway Commitment Axway Commitment will depend on Customer SLA (Silver, Gold, Platinum)

Data Required

• Date and time of registration in the event management tool (Status “OPENED”)

• Date and time of the status changes to a value other than “OPENED” performed by an Axway operator

METHODOLOGY

Required Data source

ITSM: ticketing tools

Data Record Methodology Automatic

Measurement period This indicator is evaluated every calendar month

Calculation Formula

The formula is:

Np = Total number of incidents with status changed from “OPENED” to another status during the measurement period for priority p

�� = Response time for Incident “I” where the status changed from “OPENED” to another

status during the measurement period and for the priory p

MAXDp= Maximum duration to respond to the incident for the considered priority p

�� ∑ �� ∗ ��

p= 1,2,3,4




34/40

b. MTTRestoreService

DEFINITION

Quality indicator topology Key Incident Indicator


The average Restore Service Time for all tickets of a specific priority for the

measurement period. The KPI value represents the maximum average

meantime acceptable per Priority. The MTTRestoreService will be presented as

a percentage.

• MTTRestoreService value equal to or below 100% shows the SLA has been met.

• MTTRestoreService value over 100% shows Axway did not meet this SLA.

Restore Service time is the elapsed time from ticket creation to ticket

resolution, less and time the ticket is awaiting customer feedback.


Data Required

• Date and time of registration in the event management tool (Status “OPENED”)

• Date and time of registration for information (Status “WAITING FOR CUSTOMER FEEDBACK”)

• Date and time of registration for change of status “WAITING FOR CUSTOMER FEEDBACK”

• Date and time of the last status “RESOLVED”

METHODOLOGY


ITSM: ticketing tools



Calculation Formula

The formula is

Np = Total number of incidents closed for the Priority “P” during the measurement period

��= Restore time for Incident “I” which was closed during the measurement period for the

priority “P”

MAXDp= Maximal duration to resolve the incident for the considered priority “P”

�� ∑ �� ∗ ��

P = 1, 2, 3, 4




35/40

6.4.2. Service Indicator

a. Service Availability

DEFINITION

Quality indicator topology Key Service Indicator


Measures the availability of the Axway Cloud Solution at the "Software Platform Management Level" level to ensure execution of the various services and components during the measurement period. Planned maintenance periods are excluded from calculations. The measurement is based on the duration of priority 1 incidents marked as outages. The notion of "outage" corresponds to the total unavailability of all services or the Axway platform.

Presented as a percentage.


Data Required

• Date and time of event registration ("OPENED" status)

• Date and time of registration of Axway Customer Information Request

("AWAITING CUSTOMER FEEDBACK")

• Date and time of registration of the change of status "WAITING CUSTOMER FEEDBACK" following the provision of information by the

client

• Date and time of switching to the last status "RESOLVED"

METHODOLOGY

Required Data source ITSM: ticketing tools



Calculation Formula

DurationPeriod = total duration of the measurement period less scheduled maintenance time (unit of measure: minutes). OutageDurationi = business duration of the priority 1 outages “I” during the measurement period (unit of measure: minutes). The durations of overlapping incident periods are not accumulated and are counted as a single duration.

�� !� �" � #1 % ∑ &'��(�'�� '�� ) ∗ 100

In %




36/40

b. Recovery Time Objective: RTO

DEFINITION


Quality indicator definition Measures the duration of the complete unavailability of the Software Platform Management

Level.

Axway Commitment Axway Commitment will depend on Customer SLA (Silver, Gold, and Platinum) and selected

DR option.

Data Required

• Date and time of declaration of disaster

• Date and time of registration of Axway Customer Information Request ("WAITING CUSTOMER FEEDBACK"

• Date and time of registration of the change of status "WAITING CUSTOMER FEEDBACK" following the provision of information by the customer

• Date and time of transition to "RESOLVED" status corresponding to the resumption of activity in Service degraded or Service operational.

• Date and time of transition to "CLOSED" status

METHODOLOGY


ITSM: ticketing tools and Axway Cloud management

Data Record Methodology Manual ticket entry recording management decision to declare disaster

Measurement period Only when a disaster is declared for production and datacenter is not available

Calculation Formula

RTO = date of resolution of disaster incident - date of creation of disaster incident

= Date of changeover to "RESOLVED" status - creation date ("OPEN" status)




37/40

c. Recovery Point Objective: RPO

DEFINITION


Quality indicator definition Measures the duration between the last backup or snapshot and the declaration of a disaster.

Axway Commitment Axway Commitment will depend on Customer SLA (Silver, Gold, and Platinum) and the

selected DR option.

Data Required • Date and time of the creation of disaster incident (Status « OPENED »)

• Date and time of the last backup snapshot available before the incident

METHODOLOGY


ITSM: Ticketing tools and AWS backup tools and Axway management decision

Data Record Methodology Manual ticket entry recording management decision to declare disaster

Time stamp of the last backup snapshot from the system

Measurement period Only when a disaster is declared for production and datacenter is not available

Calculation Formula

RPO = creation date of the disaster incident – date of the last snapshot available

= creation date ("OPEN" status) - Date of the last snapshot available




38/40

7. Restrictions specific to certain analytical functions

7.1. Analyzes data from application users ("App Users")

The Customer may disable the analytical part of the Product, which collects anonymous data relating to

the Applications; However, disabling the analytic portion will prevent the Customer from accessing the

analytical features of the Product. If Customer elects to use the analytical features of the Product, Axway

may collect certain information, including, but not limited to, data relating to the platform used,

timestamp, identifier, model, device manufacturer Used, the operating system, the version of the

Titanium SDK, the geolocation data, from the App Users. Subject to payment by the Customer of the

costs corresponding to the data analysis part, Axway will organize and regularly make this information

available to the Client. In addition, Axway may use this information to compile and disclose statistical

analysis and reports based on aggregated data derived from this information. The Customer is not

authorized to create custom fields to collect and send personal data on its App Users to Axway.

7.2. Data related to the usage of the product

In connection with the operation of the Products, Axway collects and receives data relating to the use of

the Products by the Customer and its Nominated Users and may, in accordance with Axway's Privacy

Policy, (i) use such data (Ii) disclose such information to third parties in connection with the operation

of the Products, (iii) disclose the information to third parties where required by applicable laws or

regulations, or (iv) use and disclose it They do not specifically identify the Customer, and (v) use them

to monitor Customer's compliance with the terms of this Agreement. THE CUSTOMER ACKNOWLEDGES

AND ACCEPTS THAT THE PRODUCT CAN CONNECT TO THE INTERNET AND AXWAY'S SYSTEMS TO

REPORT INFORMATION TO AXWAY THAT CAN CONFIRM THE COMPLIANCE WITH THIS AGREEMENT AND

TO COLLECT USE DATA OF THE PRODUCT UNDER THE EXPECTED CONDITIONS THIS AGREEMENT AND

AXWAY'S PRIVACY POLICY.

7.3. Customer Privacy Policy

In order to use the Products, the Customer must have a privacy policy that specifies (i) the Customer's

App Users and other information collected by the Customer and / or Axway on behalf of the Customer

and (ii) The possible uses of this data and other information by Customer and / or Axway on behalf of

the Client. Without limiting the foregoing, the Customer's privacy policy shall specifically specify that a

third party may collect, on behalf of the Customer, data and other information relating to or derived from

App Users and their devices.

7.4. USE OF AXWAY CLOUD SERVICES ("ACS").

ACS is designed to provide Customer with optional back-end technologies for activation of Customer's

Cloud services. If the Customer chooses to deploy the ACS in its Application (s), the terms and conditions

of the ACS available will apply to use by and shall be expressly incorporated into this Agreement by




39/40

reference. In the event of any conflict between the terms and conditions of the ACS and the terms of

this Agreement, the terms of the ACS will apply only to the provision of the ACS.

7.5. USE OF AXWAY PERFORMANCE MANAGEMENT SERVICES ("APMS")

7.5.1. Use

The APMS listed in the Purchase Order between Axway and the Customer may only be used for the

correction of anomalies, performance monitoring and performance management and other analyzes

relating to the Applications and within the limits of the subscription period and Number of Users specified

in the Purchase Order. The Application (s) integrate integration code (the "APMS Integration Code") in

order to transmit data from the Application (s) to the APMS. The types of data transmitted and the

frequency of the transmissions are defined by the Client alone, by the configuration made by the Client

of the Integration Code APMS. The Client may reproduce and distribute the APMS Integration Codes only

when they are incorporated in the Application (s) and used only for the purpose of transmitting data

from the Application (s) to the APMS.

7.5.2. Data

Axway (or a third-party provider on behalf of Axway) collects, receives and generates data relating to

Customer's Use of APMS ("Customer Data") and Application Usage by App Users ("Data App Users ").

The Customer authorizes Axway (and third party service providers on behalf of Axway subject to

confidentiality obligations) to use, reproduce, and distribute the Customer Data and User Data relating

to the use of the APMS by the Customer. The Customer also grants to Axway (and / or a third-party

provider on behalf of Axway) the perpetual, irrevocable and worldwide right to use, reproduce and

distribute the Customer Data and Aggregated with other information or when they do not specifically

identify the Client or an App User. Customer also agrees that Axway (and / or a third party provider on

behalf of Axway) may disclose the Customer Data and App Users Data when required by applicable laws

or regulations or legal process. The Client undertakes not to transfer to Axway (and / or a third-party

provider acting on behalf of Axway) any Personal Data, financial information, health, medical,

pharmaceutical data or data concerning Children under the age of 13, or any other sensitive data (social

security number, for example), or data that is used for advertising targeting a particular device or App

User. The Client is solely responsible for ensuring that its Application (s) and its use of APMS (including,

but not limited to, the provision by the Customer of App Users Data to Axway (and / or a third party

service provider acting On behalf of Axway)) complies with all applicable laws, rules and regulations. The

Customer shall obtain and maintain all rights required to allow the transfer of App Users Data to Axway

(and / or a third party provider acting on behalf of Axway) and authorize Axway (and / or a third party

service provider acting on behalf of Axway Axway) to use the App Users Data in accordance with this

Agreement.




40/40

7.5.3. Confidentiality

APMS is considered confidential information of Axway (and / or the third-party provider acting on behalf

of Axway) and Customer Data and App Users data are considered confidential customer information;

And subject to the provisions of this Section 3, each Party agrees to keep such confidential information

of the other Party confidential under the terms of the Contract.

End of document