Annex B — SaaS Technical Documentation

The Compri SaaS solution can be purchased by entering into a valid Commercial Agreement. The license fee must be paid annually and will last for the duration of the Commercial Agreement. The implementation cost is a one-time payment.

All Compri data and infrastructure are hosted in the AWS eu-west-1 Region (Dublin, Ireland), ensuring compliance with EU requirements. Backups are replicated to a different AWS Region within the EU. Compri will notify of any changes to data location with at least 30 days' notice.

• Versions: Compri deploys the latest generally available version of the service.
• Environments: Compri provides a production environment and a sandbox environment for testing. Only sections 3 and 4 apply to the sandbox.
• SLA: applicable to the production environment only.
• Security and access measures: passwordless approach. SSO with the customer's provider is recommended; alternatively, magic link authentication. Each user must have a valid email address.

Compri logs connections and actions associated with user IDs to ensure CIA (Confidentiality, Integrity, Availability). Data is retained for no more than 90 days.

Vulnerability assessments follow this indicative schedule:

• External dynamic scans: quarterly
• Internal vulnerability scans: quarterly
• Internal static scans: quarterly
• New infrastructure components: upon insertion

Compri reserves the right to limit API access to preserve uptime. For planned maintenance: 7 days' notice. For emergency maintenance: Compri will make every reasonable effort to provide 48 hours' notice.

Compri — Uptime guarantee (business hours, 9:00-18:00, Mon-Fri, excluding holidays): 99.9%

Compri — Total availability (outside business hours): 99%

Compri monitors the system every 5 minutes, 24/7. Scheduled downtime is excluded from the calculation.

Compri — Service level below 99.5% quarterly: credit of 1 month of fees

• Data backup: daily backup replicated to an alternate location. Maximum data loss: 24 hours.
• Daily backups retained for 21 days
• No removable media for backup
• All data encrypted at rest with AES-256

Compri is configured with a DR site that replicates the primary site. The switch is tested periodically.

Compri — Recovery Time Objective (RTO): 4 hours

Compri — Recovery Point Objective (RPO): 24 hours

Recovery Time Objective (RTO): the time within which the service must be restored following a serious incident.

Recovery Point Objective (RPO): the maximum period during which data could be lost due to a serious incident.