Partner Service Level Agreement (SLA) Terms

Services To Be Provided

Campus Web Services Partner Program

The different levels of the Partner Program are based on the number of websites covered and the amount of support hours available. Each Service Level provides platform level support for up to a certain number of sites. The hosting costs are determined separately on a site by site basis. Any websites that are already active at the start of the agreement term will be included in this agreement. Additional sites may be added during the term of this agreement via an addendum.

Service Level 1

Up to 10 Sites

Up to 20 support hours

$1,200/year

Service Level 2

Up to 25 Sites

Up to 40 support hours

$2,400/year

Service Level 3

Up to 50 Sites

Up to 60 support hours

$3,600/year

If the total number of sites or support hours exceed the limits of the Service Level in this agreement, Campus Web Services may, at their discretion, continue to operate under the current Partner Program Level fee structure and re-evaluate the appropriate level upon renewal of this agreement. In the event that this is abused, Campus Web Services reserves the right to increase the Partner Program Level and the Partner will be financially responsible for the higher rates. Campus Web Services will communicate with the Partner once they cross the threshold to determine the appropriate course of action.

As part of the Partner Program, The Partner will have access to hosting packages at our negotiated rates with Pantheon Systems, Inc.  The provided Pantheon Hosting Packages encompass the infrastructure and capacity aspects of providing a web site such as storage for files, network connectivity, maintenance of servers, backups and other server related items.

Hosting administration, oversight and coordination will be provided by Campus Web Services. This hosting environment will provide:

  1. A secure environment for hosting. Details available at https://pantheon.io/security
  2. Managed TLS certificates to provide https via Let’s Encrypt.
  3. Automated nightly backups for sites with paid plans.
    1. Nightly backups kept for a week.
    2. Weekly backups kept for a month.
    3. Manual backups available upon request may be kept for up to one year.
  4. Edge caching provided by Pantheon’s Global CDN for faster page loads.
  5. Dev, Test and Live environments to ensure smooth patching.
  6. Multi-dev environment available for ongoing development.
  7. 24/7 monitoring provided by Pantheon

Each Pantheon Hosting Package is intended for sites with a certain number of page views per month. If that limit is exceeded for two consecutive months the hosting package may be upgraded according to Pantheon’s documentation. https://pantheon.io/docs/traffic-limits/ Any additional fees incurred will be the responsibility of the Partner. Campus Web Services will do our due diligence to notify the Partner of any increased costs 30 days in advance.

See Appendix A for additional technical specifications and hosting level packages.

Campus Web Services will maintain the Quickstart Upstream that is available on the platform. Campus Web Services will make regular security and maintenance updates to this upstream to include all Drupal Core and Contributed Module security updates as well as ongoing bug fixes, feature improvements and changes to UA Brand Guidelines that are contributed to Quickstart by UA Digital.

Drupal security updates will be available on the Upstream depending on severity:

UA NetID authentication for Drupal users is included and configured within Quickstart.

Platform Support Services

Campus Web Services will provide both Ticketed Support and Chat Support for issues that the Partner would like assistance with, during business hours. This support is targeted at platform specific issues and is not intended for website specific support except for issues that arise from the website interfacing with Pantheon.

  1. To open a support ticket, submit a Web Services Request at https://it.arizona.edu/web-services-request
  2. Chat support will be available through a Slack channel that The Partner will be granted access to upon acceptance of this agreement.

  1. Limited troubleshooting and Q&A
  2. Small fixes and miscellaneous issues requiring fewer than 5 hours.
  3. Guidance on resolving issues related to email.
  4. Guidance on modifying Partner Websites to accommodate changes in the platform.

  1. Project work and site enhancement work, including website usability, design or development requests requiring more than five hours of resource time will be addressed with a separate Service Agreement.
  2. Applying updates or patches to specific websites.

New Website Launches

Under this agreement, the Partner will have access to creating new sandbox sites and will have full access to the Dev, Test and Live environments. When a site is ready to launch, the Partner will need to submit a Web Services Request at https://it.arizona.edu/web-services-request to arrange the launch and submit an addendum to this SLA that identifies the Websites and billing information for hosting costs.  A week’s notice is recommended, a minimum of 2 business days’ notice is required for new site launches.

  1. Update the Website’s Pantheon plan from Sandbox to the appropriate level.
  2. Work with UITS Operations to implement all necessary DNS changes for records that are controlled by UITS Operations.

Detailed Responsibilities

  1. Campus Web Services will apply all necessary security updates to Drupal core and contributed modules to the Pantheon upstream for UA Quickstart and post release notes in the Pantheon Partner Slack channel when they are released.
  2. Campus Web Services will respond to work requests in a timely manner and address production issues and new work requests in accordance with the terms identified in this agreement and Appendix B.

  1. The Partner is responsible for making all content updates to their site and making sure that the content remains up to date and relevant.
  2. The Partner is responsible for owning all of the relevant Webauth records for each of the Websites that they manage.
  3. The Partner is responsible for the security of their sites in accordance with the policies set forth by the Information Security Office (ISO) found at: https://security.arizona.edu/content/policy-and-guidance.
  4. The Partner is responsible for ensuring that all Drupal Core and Contrib module updates are applied in a timely manner in accordance with the recommendations of Drupal’s Security Advisory Policy: https://www.drupal.org/node/475848
  5. The Partner will respond in a timely manner to any and all communications from Campus Web Services.
  6. The Partner will proactively communicate any changes in personnel that affect who the appropriate contacts for the Websites should be.
  7. The Partner will notify Campus Web Services as soon as reasonably aware of any evidence of a security breach is discovered, such as: hacking, defacement or denial of service attacks.
  8. The Partner will request work in accordance with the terms identified in this agreement.

Access to websites and environment

  1. Campus Web Services do not require Drupal Administrator access, but are able to gain access if it becomes necessary to assist with support of the Websites.
  2. Campus Web Services will have access to push code to Dev, Test and Live environments, but will refrain from doing so unless it becomes necessary to take over support of the Websites or to complete a Service Request and in all cases, we will notify the Partner of changes.

  1. Partner will have Drupal Administrator access to all Websites covered in this agreement.
  2. Partner will have access to push code to Dev, Test and Live environments in Pantheon.
  3. Partner will see all Websites covered in this agreement in the Pantheon dashboard.
  4. Partner will have access to make changes to all Websites covered in this agreement via Terminus.
  5. Partner will have access to create new Sandbox sites.
  6. Partners will be defined as the “User In Charge” (UIC) of all sites covered in this agreement, and all Sandbox sites they have created which are not explicitly covered in this agreement.
  7. Partner will have access to create new Multi-dev environments on all sites for which they are the UIC.
  8. Partners will be defined as “Unprivileged Users” within the Campus Web Services Pantheon organization.

See https://pantheon.io/docs/change-management/#organizations-roles-and-permissions for more details on the permissions granted with these roles.

 

  1. Partner must have developers on staff with a technical title. i.e. Website Developer, Applications Analyst Systems/Developer or similar at the discretion of Campus Web Services.
  2. Partner must have both the ability and the capacity to manage and maintain all websites covered in this agreement.
  3. Partner must have a dedicated point person (with backup) to communicate all necessary security updates
  4. Partner must apply all security updates within the timeframes established by UITS. Depending on the criticality of the security updates, this timeframe could be as short as one day.

Partners attest that upon agreement of this SLA, they meet all of the necessary requirements listed above.

If the Partner’s staffing levels or other circumstances change so that it becomes necessary for Campus Web Services to assume additional temporary responsibility of maintaining Partner’s websites, notify us immediately to determine whether or not we will be able to assume this responsibility.

If Campus Web Services does have the capacity, the Partner will be charged according to the following expected workloads:

  • 15 hours/year per site using the Quickstart Upstream
  • 30 hours/year per non-Quickstart site

These are billed at $60/hour and prorated monthly.

AZ Sites

All sites that are labelled as AZ Sites will be maintained and supported by Campus Web Services.

  1. Campus Web Services is responsible for owning all of the relevant Webauth records for each of the Websites that they manage.
  2. Campus Web Services is responsible for the security of their sites in accordance with the policies set forth by the Information Security Office (ISO) found at: https://security.arizona.edu/content/policy-and-guidance.
  3. Campus Web Services is responsible for ensuring that all Drupal Core and Contrib module updates are applied in a timely manner in accordance with the recommendations of Drupal’s Security Advisory Policy: https://www.drupal.org/node/475848

  1. Drupal Admin access will be restricted to Campus Web Services.
  2. Pantheon Platform access will be restricted to Campus Web Services.
  3. Campus Web Services will be defined as the “User In Charge” (UIC) of all sites covered in this agreement as AZ Sites.
  4. The Partner will have Content Administrator access.

Contact Information

Contact personnel are listed below. Each party is responsible for notifying the other of any changes to the contact information. Any issues regarding this Agreement, including renewals or notices, should be addressed to the contact personnel listed below.

Should either party fail to provide timely communication of contact personnel changes, the other party shall bear no responsibility for any failures in communication that result.

Non-Business Hours Emergency Contact
24/7 IT Support Center
626-8324 (626-Tech)
support@arizona.edu

Primary Contact
Cameron Green
Program Manager, Campus Web Services
camerong@arizona.edu

Escalation Contact
Donna Bieg
Director, Campus Web Services
621-4860
donnabieg@arizona.edu

Billing Contact
Sarah Swanson
Program Coordinator
520 626-5918
sarahs@arizona.edu

Appendix A – Pantheon Technical Specifications and Pricing

Rates are based on current annual agreement with Pantheon and may change from fiscal year to fiscal year.

  Basic
$250/year		 Performance - S
$960/year		 Performance – M
$2,040/year		 Performance - L
$3,840/year
Monthly Visits Up to 25,000 Up to 25,000 Up to 50,000 Up to 150,000

SSD Storage

 Up to 20GB 30GB 50GB 100GB

Application Memory Limit

 256MB 256MB 512MB 512MB
99.9% Uptime SLA Not Available 99.9% 99.9% 99.9%
Domains 5 10 15 35
HTTPS Included Included Included Included
Automated Backup Retention 1 month 6 months 6 months 6 months
PHP Workers 4 8 16 24
Application Cache Not available Redis Redis Redis

 

Appendix B – Issue Priority Levels and responses

The Client will have access to Pantheon status alerts as well as the option of directly contacting Pantheon support via the chat option available in their dashboard.

In the case that Campus Web Services becomes aware of an issue before the Client does, we will open a support ticket and contact the Client via the dedicated Slack channel. If the Client becomes aware of an issue before Campus Web Services, they must follow the process below to receive the appropriate response times for the priority level of the issue.

Definition: User facing minor cosmetic issues, or functionality that only affects admin users and is not time critical.

Process: Submit a Service Request through it.arizona.edu/web-services-request.

Response times: Campus Web Services will contact the Client regarding the ticket within two business days and make a best effort to have the issue resolved within a week.

Definition: User facing major cosmetic issues, or functionality that only affects admin users and is time critical. Alternatively, one or more of a Client‘s websites are down that only affect a small number of campus stakeholders or is during a non-critical time.

Process: Submit a Service Request through it.arizona.edu/web-services-request and follow up via the dedicated Slack channel.

Response times: Campus Web Services will contact the Client regarding the ticket within 4 business hours and make a best effort to have the issue resolved within two business days.

Definition: One or more of the Client’s websites are down that affect a large number of campus stakeholders or is during a critical time such as during an event or event registration drive.

Process: Submit a Service Request through it.arizona.edu/web-services-request and follow up via the dedicated Slack channel.

Response times: During business hours Campus Web Services will contact the Client regarding the ticket within 30 minutes and make a best effort to have the issue resolved as quickly as reasonably possible.

If it is outside of business hours, or you have not received a response within half an hour, reach out to Pantheon directly through the chat support options available in your dashboard.

Appendix C - General Terms and Conditions

Campus Web Services and The Partner agree to comply with all applicable University of Arizona security standards, guidelines and policies as noted at https://security.arizona.edu/content/policy-and-guidance. As noted above, The Partner agrees to contact Campus Web Services immediately if a website security issue is noticed or suspected. Campus Web Services reserves the right to disconnect from the network any website that has been compromised. ISO must be notified by The Partner, of any event that has the potential to negatively impact the confidentiality, integrity, or availability of University Data.

Whenever possible, UA WebAuth should be used to authenticate all user logins to Drupal sites. Campus Web Services recommends using the Drupal CAS module (https://www.drupal.org/project/cas) for this purpose and disabling non-CAS logins. Sites that require logins for users without UA NetIDs should consider using third-party authentication service which employs OpenID Connect (e.g. Google). Sites that are not able to use UA Webauth or a secure third-party authentication service for all Drupal logins are required to enforce HTTP Secure (https) for all website traffic and are subject to more frequent security reviews.

Payment Card Transactions are not allowed within UA Sites. Sites that link out to a separate payment gateway may require additional levels of compliance and both Campus Web Services and the University Financial Services Office must be notified.

Personally Identifiable Information (PII) is not allowed on the provided hosting environment. This includes any data that is considered protected under HIPAA or FERPA. Campus Web Services and The Partner mutually agree to keep all non-public information and data concerning the other party’s business confidential, including, but not limited to, ideas, products, customers or services. This includes any information or data that is of a personal, proprietary or trade secret nature. Confidential information will remain the property of the disclosing party and the receiving party will not acquire any rights to that information. Both parties agree to adhere to the policies available at https://security.arizona.edu/content/policy-and-guidance

If The Partner requires Campus Web Services resources beyond the services outlined in this SLA, there may be an additional charge to be determined at the time of the service request. If the services are extensive or require significant Campus Web Services staff time, then Campus Web Services may require a new SLA or an addendum to this Agreement before rendering services.