Service Level Agreement
Published commitments that every Evolv client receives, by default, with every Computing-as-a-Service subscription.
Why we publish our SLAs.
Most regional MSPs don't publish Service Level Agreements. They promise "responsiveness" or "best effort." Procurement teams in regulated industries know to ask for specifics, and the answers they get are usually vague. Evolving Technology Solutions publishes the numbers because we built our platform to deliver them, and because buyers deserve to know what they're getting before they sign.
Response & Resolution SLAs.
| Priority | First-Response Time | Resolution Target | Coverage |
|---|---|---|---|
| P1, Critical (system down, security incident, ransomware) | Under 15 minutes | Resolution within 4 hours | 24/7/365 |
| P2, High (major function impaired, productivity-blocking) | Under 1 business hour | Same business day | Business hours + after-hours escalation |
| P3, Medium (single-user issue, non-blocking) | Under 4 business hours | Within 2 business days | Business hours |
| P4, Low (request, question, scheduled work) | Under 1 business day | Scheduled per agreement | Business hours |
Security SLAs.
| Metric | Commitment |
|---|---|
| Mean Time to Detect (MTTD) for known threats | Under 15 minutes |
| Mean Time to Respond (MTTR) for critical security events | Under 30 minutes |
| 24/7 SOC analyst review of all alerts | Yes, every alert reviewed by a human |
| Threat hunting cadence | Continuous, with proactive IoC scans |
Backup & Recovery SLAs.
| Metric | Commitment |
|---|---|
| Recovery Time Objective (RTO) for image-based backups | Under 60 minutes |
| Recovery Point Objective (RPO) for production servers | 1 hour or better |
| Backup verification cadence | Daily |
| Disaster Recovery runbook testing cadence | Quarterly |
Patch Management SLAs.
| Patch Class | Deployment Timeline |
|---|---|
| Critical security patches | Within 72 hours of vendor release |
| High-severity patches | Within 7 days |
| Standard patches | Monthly patch cycle |
| Patch success rate target | 98%+ |
Compliance Evidence SLAs.
For clients in regulated industries, we collect and deliver audit-ready evidence on a quarterly cadence. Evidence package includes patching records, MFA enforcement logs, training completion reports, backup verification, and incident response timelines, mapped to your framework's control set.
Exclusions and notes.
SLA commitments apply to incidents within Evolv's managed scope and are subject to standard exclusions including: events caused by force majeure (natural disasters, acts of war, widespread carrier outages); scheduled maintenance windows communicated at least 48 hours in advance; incidents caused directly by client-initiated configuration changes or unauthorized third-party actions; and outages attributable to third-party vendor systems or cloud platforms outside Evolv's management scope (e.g., Microsoft Azure, Google Cloud, upstream ISP outages). In the event of an exclusion-qualifying incident, Evolv will communicate status and estimated resolution on the same SLA cadence as a standard incident, even where formal SLA guarantees do not apply.