Service Level Agreement
This translation is provided for convenience. Only the German version is legally binding.
for the use of the faktoora SaaS platform
GDPR · GoBD · ISMS aligned with ISO/IEC 27001:2022
⬇ Download the SLA as PDF (v4.2)
Note: This version applies from 01.12.2026. Until 30.11.2026, the previous version applies: SLA version 4.1 (PDF).
| Version | Valid from | Last review | Responsible |
|---|---|---|---|
| 4.2 | 01.12.2026 | 29.10.2026 | faktoora GmbH – Management |
01 · Introduction and Purpose
This Service Level Agreement (SLA) of faktoora GmbH governs the service levels of the faktoora SaaS platform and describes security, business continuity and support operations. It supplements the main contract and the data processing agreement (DPA) pursuant to Art. 28 GDPR.
Binding service commitments are contained in sections 4, 5 and 10.1. The remaining sections describe the current status of the measures; faktoora may adapt them in accordance with clause 4(2) of the DPA, provided that the level of protection is not undercut. Annex 2 of the DPA is binding for the technical and organisational measures under Art. 32 GDPR. faktoora does not give any guarantees within the meaning of clause 9.2 of the T&Cs with this SLA.
This document is guided by the requirements of the following standards:
- ISO/IEC 27001:2022 – information security management system (ISMS aligned with the standard)
- GDPR – General Data Protection Regulation
- GoBD – German principles for the proper keeping and retention of books, records and documents in electronic form and for data access
This SLA applies to customers on the Enterprise plan (formerly "Custom") with an active contract. Customers on another paid plan whose contract was concluded before 01.12.2026 keep the SLA for the term of that contract (grandfathering). It does not apply to other plans or to free trial accounts unless expressly agreed in text form.
This version applies from 01.12.2026. For customers whose contract was concluded before that date, it applies from 01.12.2026, but no earlier than four weeks after receipt of the notification of amendment, unless the customer objects in accordance with clause 8.10 of the T&Cs; until then, the previous version applies.
02 · Scope
This SLA applies to all services and components that faktoora operates directly, in particular:
- the faktoora SaaS platform (web application and API)
- authentication and authorisation infrastructure
- data storage and database operation
- backup and recovery infrastructure
- support services in accordance with section 5
Expressly not covered: services of third-party providers (external payment providers, email service providers, network infrastructure of internet service providers, the customer's devices).
03 · Definitions
| Term | Definition |
|---|---|
| Availability | Percentage of a calendar month without downtime. |
| Downtime | Period during which the web application and API cannot be reached at the router exit of the data centre (clause 2.2 of the T&Cs), as determined by faktoora's monitoring; planned maintenance and the exclusions under section 4.3 are excepted. |
| Planned maintenance | Maintenance within the fixed maintenance windows and announced major maintenance within the scope of section 9.1, during which the platform may be restricted or unavailable. |
| Response time | Time between receipt of a report and the first qualified response from faktoora. |
| RTO (Recovery Time Objective) | Targeted time from failure until operational readiness is restored, counted within business hours (target value). |
| RPO (Recovery Point Objective) | Targeted maximum data loss period in an emergency (target value). |
| Incident | Security incident or disruption that impairs availability or data security. |
| SLA credit | Monetary credit against the monthly fee as compensation for an SLA breach. |
| Change | Change to system components, configurations or software versions. |
| ISMS | Information security management system, aligned with ISO/IEC 27001:2022. |
| Audit log | Tamper-evident record of all security-relevant events and accesses (append-only, cryptographic hash chain). |
04 · Availability of the Platform
4.1 Availability Commitment
Within the scope of this SLA, faktoora commits to a minimum monthly availability of 99.5 %.
| Service tier | Availability/month | Max. downtime/month | Max. downtime/year |
|---|---|---|---|
| Enterprise plan and existing customers (section 01) | 99.5 % | approx. 3.6 hours | approx. 43.8 hours |
The availability commitment refers to the time outside the fixed maintenance windows under section 9.1 (Mon–Fri 18:00–22:00 and all day on Saturdays). Times within these maintenance windows and announced major maintenance under section 9.1 of up to a total of 8 hours per calendar month are not included in the calculation of availability.
Measurement method
Availability is calculated on the basis of faktoora's internal incident documentation; the customer may object to the calculation by presenting its own records. The measurement period is the calendar month. Planned maintenance within the scope of section 9.1 does not count as downtime. Customers can request a status enquiry by email at any time; an overview of documented incidents is available on request. The platform is monitored automatically.
4.2 SLA Credits in the Event of Non-Compliance
If the committed availability is not met, the customer is entitled to the following credits:
| Actual availability | SLA credit |
|---|---|
| 99.0 % to < 99.5 % | 5 % of the monthly fee |
| 95.0 % to < 99.0 % | 10 % of the monthly fee |
| < 95.0 % | 25 % of the monthly fee |
Credits must be claimed in text form at support@faktoora.com within 30 days after the month concerned. They are limited to the monthly fee for the period concerned; in the case of annual billing, one twelfth of the annual fee is deemed the monthly fee. SLA credits settle any claims for reduction of the fee due to availability falling below the commitment. Exceeding response times (section 5.2) does not trigger SLA credits. SLA credits are offset against any claims for damages; otherwise, the liability provisions of the T&Cs (clause 9) apply.
4.3 Exclusions
The following periods do not count as downtime:
- maintenance in the fixed maintenance windows under section 9.1
- announced major maintenance outside the fixed maintenance windows under section 9.1, up to a total of 8 hours per calendar month
- force majeure (natural disasters, strikes, government intervention)
- outages caused by the customer or by third parties that are not faktoora's vicarious agents
- network outages at internet service providers
- DDoS attacks that exceed the protection mechanisms of the hosting provider
05 · Support Services
5.1 Contact and Business Hours
| Channel | Address / number | Availability |
|---|---|---|
| Email (standard) | support@faktoora.com | 24/7 receipt; handling Mon–Fri 09–17 (CET/CEST) |
| Telephone (Enterprise plan only) | +49 731 85070390 | Mon–Fri, 09:00–17:00 (CET/CEST) |
| Security incidents | security@faktoora.com | 24/7 receipt; prioritised handling in accordance with section 10 |
Business hours: Monday to Friday, 09:00–17:00 (CET/CEST), excluding public holidays in Bavaria.
5.2 Priorities and Response Times
| Priority | Description | Response time |
|---|---|---|
| A – Critical | Platform completely down or data loss. No workaround. | 1 hour |
| B – High | Essential function impaired, workaround possible. | 4 hours |
| C – Medium | Functional limitation without critical impact. | 1 business day |
| D – Low | Cosmetic errors, improvement requests, general enquiries. | 2 business days |
The response times apply within business hours (Mon–Fri 09:00–17:00 CET/CEST). Outside business hours, the time limits begin on the next business day. Priority A: critical incidents are detected by automated monitoring and handled automatically where possible; the human response takes place within 1 hour of the start of the next business hours. faktoora does not commit to resolution times; it handles disruptions according to their priority.
5.3 Escalation Procedure
The customer can escalate a report at any time by email with the subject line "ESKALATION: [Ticket-ID]" (please use exactly as given); faktoora then reviews the prioritisation and informs the customer of the next steps.
06 · Data Security and Encryption
The following information describes the current status of the measures; Annex 2 of the DPA is binding for the technical and organisational measures (TOMs) under Art. 32 GDPR.
6.1 Encryption
| Area | Standard | Details |
|---|---|---|
| Data at rest | Full disk encryption | Full encryption of all production systems. Key management via documented procedures with a restricted group of persons. |
| Data in transit | TLS 1.2 or higher | Exclusively secure protocols for all external connections. |
| Backups | Encrypted backups | Backups are transmitted in encrypted form and stored at a physically separate location. |
| Credentials | Self-operated identity provider; alternatively single sign-on via the customer's identity provider | Passwords are managed exclusively in hashed form by the identity provider; the application itself does not store any passwords. With single sign-on (e.g. Microsoft Entra ID), login takes place at the customer's identity provider. API keys are stored only as a hash. |
6.2 Backup and Recovery
| Parameter | Value |
|---|---|
| Backup frequency | Backup of all persistent data (databases, file storage, audit logs) at least every 2 hours; in addition, daily full system snapshots |
| Retention period | 14 days (daily backups); up to 12 months (monthly backups) |
| RPO (Recovery Point Obj.) | Target: 2 hours |
| RTO (Recovery Time Obj.) | Target: 8 hours within business hours for full platform recovery; individual services typically considerably faster |
| Backup location | ISO 27001 certified data centres in Germany (Hetzner), physically separate from production |
| Backup tests | Regular documented recovery exercises |
| Integrity check | Checksum-protected backups with regular integrity checks |
6.3 Resilience and Recovery
- Container platform with automatic restart of failed services
- Documented procedure for restoring the entire platform from a system snapshot on new infrastructure
- Two independent backup levels (encrypted data backups and daily system snapshots)
- Hosting in ISO 27001 certified data centres with redundant power and network supply
07 · Certifications and Compliance
7.1 Certifications and Standards
| Certification / standard | Scope | Status | Evidence |
|---|---|---|---|
| ISO/IEC 27001:2022 | ISMS of the faktoora SaaS platform | ISMS aligned with ISO/IEC 27001:2022 | Statement of Applicability (summary) on request |
| ISO 27001 – data centre | Hosting infrastructure | Certified | Data centre certificate on request |
| GDPR / Art. 28 | Processing on behalf of a controller | DPA pursuant to Art. 28 GDPR | DPA as part of the contract |
| GoBD | Storage of invoices during the contract term | Tamper-evident audit trail; protection against deletion during the contract term; statutory retention is the responsibility of the customer | Description of storage and export on request |
faktoora provides available certificates and evidence on request. Audit reports from independent bodies are made available, where available, on request and after signature of an NDA.
7.2 GoBD Compliance
- Tamper-evident audit trail (append-only, cryptographic hash chain)
- Logging of all business-relevant changes made via the application, with timestamp and user identification
- Data export via self-service as CSV and PDF, for individual data areas also as XLSX; additionally as JSON on request
- Tamper-evident storage during the contract term and complete export under clause 5.2 of the T&Cs; statutory retention (8 years for invoices and accounting vouchers, 10 years for books and records, § 147 AO, German Fiscal Code) is the responsibility of the customer
08 · Access Control and Audit Logging
8.1 Access Control
- Role-based access model (RBAC) following the least-privilege principle
- Multi-factor authentication for administrative infrastructure access (server, cloud and development access)
- Regular review of production and developer access rights
- Revocation of access without undue delay when employees leave
- Access to the production environment is restricted to a small group of named persons
- Strict separation of development, test and production environments; no automated CI/CD access to production
8.2 Audit Logging
- Logging of authentication events
- Logging of administrative changes in the application in the audit trail, and of all logins to production systems
- Append-only audit trail with cryptographic hash chain; tampering is technically detectable
- Retention of application-related audit logs during the contract term; after the end of the contract, clause 12 of the DPA applies
- Information about one's own logged data within the scope of data subject rights under the GDPR
09 · Change Management and Maintenance
Changes are subject to a formal change management process with automated quality checks and rollback capability.
9.1 Maintenance Windows
| Type | Time window | Announcement |
|---|---|---|
| Regular maintenance | Fixed maintenance windows Mon–Fri 18:00–22:00 and all day on Saturdays (CET/CEST) | No separate announcement |
| Major maintenance outside the fixed maintenance windows | As required, preferably outside business hours; up to a total of 8 hours per calendar month not counted as downtime, beyond that counted as downtime | At least 48 hours in advance by email |
9.2 Emergency Changes
- Critical security patches may be applied without prior notice
- Affected customers are informed promptly, insofar as the change has an impact on them
- Incident report available on request
10 · Security Incidents – Incident Management
10.1 Classification and Notification Obligations
| Severity | Description | Internal response (target value) | Customer notification | Notification to authorities |
|---|---|---|---|---|
| P1 – Critical | Personal data breach (Art. 4(12) GDPR), in particular loss, unauthorised disclosure or unauthorised access | Automated monitoring; assessment without undue delay during business hours, outside business hours from the start of the next business day | without undue delay, at the latest within 4 hours of classification as critical | Notification to the supervisory authority by the customer as controller (Art. 33 GDPR); faktoora provides support in accordance with clause 9 of the DPA |
| P2 – High | System compromise without confirmed data loss | Without undue delay (business hours) | Without undue delay (business hours), insofar as customers are affected | By the customer as controller, where required |
| P3 – Medium | Anomaly with possible security implications | 1 business day | On request | Usually not necessary |
| P4 – Low | Potential vulnerability without active exploitation | 5 business days | On request | Not required |
The notification obligations under clause 9 of the DPA remain unaffected; notifications to supervisory authorities concerning data that faktoora processes on behalf of the customer are made by the customer.
10.2 Incident Response Process
- Detection: identification via monitoring, alerts or customer report
- Containment: immediate damage limitation (isolation, access blocking)
- Analysis: root cause analysis and impact assessment
- Remediation: implementation of corrective measures and recovery
- Final report: internal post-incident review; summary report to affected customers on request
- Lessons learned: findings are fed into the ISMS and process documentation
10.3 Vulnerability Management
- Automated vulnerability scans in the CI pipeline (scanning of dependencies for known vulnerabilities and static code analysis)
- Regular penetration tests are set out in our testing programme
- Risk-based, prioritised remediation: critical vulnerabilities are dealt with without undue delay
- We provide summarised results of penetration tests carried out on request (under NDA)
11 · Data Protection and Data Localisation
- Hosting and storage of the platform data take place in ISO 27001 certified data centres in Germany; individual sub-processors also process data at other locations for their respective service (Annex 3 of the DPA and trust.faktoora.com)
- Transfers to third countries and the respective safeguards under Art. 44 et seq. GDPR are listed in Annex 3 of the DPA
- Processing on behalf of a controller governed in the DPA pursuant to Art. 28 GDPR
- faktoora forwards data subject requests (Art. 15–22 GDPR) concerning customer data to the customer without undue delay and supports the customer in accordance with clause 5 of the DPA
- External data protection officer: PROLIANCE GmbH, datenschutzbeauftragter@datenschutzexperte.de
12 · Audit Rights and Obligations to Provide Evidence
- The audit rights under clause 8 of the DPA apply; in the event of conflicts, the DPA takes precedence
- On request (under NDA), faktoora provides suitable evidence of its own choosing
- The provision of existing evidence and information is free of charge; clause 8(4) of the DPA applies to inspections and to individual audits and questionnaires
13 · Business Continuity and Disaster Recovery
faktoora operates business continuity and disaster recovery management.
| Parameter | Target value |
|---|---|
| RTO – entire platform | Target: 8 hours within business hours |
| RTO – individual services | Typically under 1 hour (automatic recovery) |
| RPO | Target: 2 hours |
| DR tests | Regularly, documented |
| BCP review | Regularly and after material system changes |
| Backup levels | Two independent backup levels (encrypted data backups and daily system snapshots) |
14 · Reporting and Transparency
- Overview of documented incidents and maintenance times on request
- Notification of affected customers by email in the event of incidents in accordance with section 10
15 · Validity, Changes and Special Right of Termination
- This SLA applies for the duration of the underlying main contractual relationship
- faktoora reviews the SLA regularly
- Changes are notified in text form at least four weeks before they take effect; otherwise, clause 8.10 of the T&Cs applies accordingly (objection, termination of the main contract until the change takes effect)
- The current SLA is available at faktoora.com/dokumente
16 · Acknowledgement
This SLA forms part of the main contract and is deemed accepted upon conclusion of the contract. A separate signature is not required unless otherwise agreed in the main contract.
faktoora GmbH · Service Level Agreement · v4.2 · valid from 01.12.2026