Legal · Service levels
Service Level Agreement
What you can count on from kolm: how fast we deliver an audit, the availability of the verification path your buyers rely on, and how quickly we respond when something needs attention. These commitments apply to paid engagements as set out in your order form.
1. Audit turnaround
Turnaround is the commitment we price on. It is a clock, not a dollar figure. From the moment we have the inputs we need (agreed scope, access or log import, and a named technical contact), we target delivery of the signed evidence report within the window stated on your order form for the tier you selected. Express engagements target the shortest window; Standard and Advanced add depth and adjust the window accordingly. If we are tracking behind, we tell you before the deadline, not after.
2. Verification availability
A report is only useful if a buyer can check it. Verification has two independent paths, and the durable one does not depend on us:
- Offline, in-browser verification at /verify runs entirely in the buyer's browser against the signature embedded in the report. It works with no kolm account and no call to our servers, so it is available whenever the buyer's own device is.
- The hosted verification endpoint and transparency log carry a target monthly availability of 99.9%, measured as successful responses over total valid requests in a calendar month, excluding scheduled maintenance announced at least 48 hours in advance.
Because verification can be performed offline, a hosted-endpoint outage never invalidates a report you already hold.
What a 99.9% target means in practice, as a downtime budget over a 30-day month:
Scheduled maintenance announced at least 48 hours in advance is excluded from the calculation.
3. Support response targets
| Severity | Definition | Target first response |
|---|---|---|
| Critical | Verification path down, or a signed report cannot be validated | 4 business hours |
| High | Active engagement blocked; delivery at risk | 1 business day |
| Normal | Questions, scoping, report clarifications | 2 business days |
Business hours are 09:00 to 18:00 US Eastern, Monday to Friday, excluding US public holidays. The contact for all severities is dev@kolm.ai.
4. Remedies
If we miss the verification-availability target in a calendar month, you may request a service credit (a reduction on your next bill)A service credit is money taken off your next invoice, not a cash refund. The amount is proportional to how far we fell short, capped at one month of your recurring fee. against the next invoice, proportional to the shortfall, up to one month of the applicable recurring fee. If we miss a committed audit-turnaround window for reasons within our control, the remedy is set out in your order form, typically a fee adjustment on that engagement. Service credits are the sole and exclusive remedy for missed targets, and are requested in writing to dev@kolm.ai within 30 days of the affected period.
5. Exclusions
These targets do not apply to delays caused by incomplete or late inputs from the customer, scope changes mid-engagement, factors outside our reasonable control (including upstream provider or network outages), or use of the services outside the Acceptable Use Policy. Findings in a report describe the posture we observed within the agreed scope; this SLA covers service delivery, not the security outcome of any tested system.
Scope is contractual. Permission posture, redaction and audit-trail integrity are assessed. Injection is tested and reported, not warranted.
6. Changes & contact
We may revise these commitments; material changes appear in the "last updated" date and apply to engagements ordered after that date. Questions go to dev@kolm.ai.
Commitments you can hold us to.
These targets apply the moment an engagement starts. Begin one, or read the terms behind them.
Caveats: Scope is contractual. Permission posture, redaction and audit-trail integrity are assessed. Injection is tested and reported, not warranted.