Website Maintenance SLA: Contract Template & Guide for Malaysian Companies

Why "Best Effort" Web Support Is a Legal & Operational Liability

When Malaysian corporate enterprises (Sdn Bhd, PLT, Berhad) enter into a website maintenance agreement, they frequently sign vague proposals containing phrases like: "Agency will provide ongoing technical support and maintenance on a best-effort basis."

In contract law, "best effort" is meaningless. It provides zero financial remedy if your corporate website is defaced by hackers, zero performance guarantee when your e-commerce gateway crashes during a flash sale, and zero contractual obligation for the agency to respond within 15 minutes instead of 4 business days.

A Service Level Agreement (SLA) is a legally binding contract that establishes precise, enforceable performance metrics: uptime percentages, incident severity response windows, disaster recovery timelines (RPO/RTO), and regulatory compliance standards under Malaysian law (PDPA 2010).

In this guide, we provide a complete breakdown of what an enterprise-grade website maintenance SLA must contain, provide a battle-tested Malaysian contract template, and outline how to hold technical vendors accountable.

---

The 4 Core Pillars of an Enterprise Web Maintenance SLA

graph TD
    A[Enterprise Web SLA] --> B[1. Uptime Guarantees & Penalties]
    A --> C[2. Incident Severity P1-P4 Matrix]
    A --> D[3. Disaster Recovery: RPO & RTO]
    A --> E[4. Asset Ownership & Legal Compliance]
    
    style B fill:#1e293b,stroke:#3b82f6,stroke-width:2px,color:#fff
    style C fill:#1e293b,stroke:#10b981,stroke-width:2px,color:#fff
    style D fill:#1e293b,stroke:#f59e0b,stroke-width:2px,color:#fff
    style E fill:#1e293b,stroke:#ef4444,stroke-width:2px,color:#fff

1. Uptime Commitments & Service Credit Schedules

Uptime cannot simply be promised; it must be calculated using a standardized mathematical formula:

$$\text{Uptime Percentage} = \frac{\text{Total Minutes in Month} - \text{Unscheduled Downtime Minutes}}{\text{Total Minutes in Month}} \times 100$$

• 99.9% Uptime (Standard Tier): Allows a maximum of 43 minutes and 49 seconds of unscheduled downtime per calendar month.
• 99.95% Uptime (Mission-Critical Tier): Allows a maximum of 21 minutes and 54 seconds of downtime per month.
• Service Credits: If the vendor fails to meet the guaranteed uptime threshold, financial penalties apply (e.g., a 10% to 50% credit applied directly against the subsequent monthly retainer invoice).

2. Incident Classification & Response Time Matrix

Every technical issue must be classified objectively based on business impact, with contractual maximum response and resolution targets:

3. Disaster Recovery Metrics: RPO and RTO

An SLA must explicitly define the disaster recovery capabilities of the vendor:

• Recovery Point Objective (RPO): The maximum age of data that must be recovered from offsite storage. For standard corporate websites, RPO is $\le 24\text{ hours}$. For high-volume e-commerce stores, RPO must be $\le 1\text{ hour}$.
• Recovery Time Objective (RTO): The maximum permissible duration to fully restore service following a total server catastrophe (e.g., complete hardware destruction at an Exabytes or AWS data center). Standard enterprise RTO is $\le 2\text{ hours}$.

4. PDPA 2010 Compliance & Security Incident Protocols

Under the Malaysian Personal Data Protection Act 2010 (PDPA) and general corporate governance standards:

• The maintenance vendor acts as a Data Processor and must enforce industry-standard access controls (2FA/MFA, least-privilege role separation).
• In the event of a suspected data leak or database compromise, the vendor is contractually mandated to notify the client in writing within 24 to 72 hours, providing full server log telemetry for forensic analysis.

---

Production-Ready Website Maintenance SLA Contract Clause

Below is an excerpt of standardized contractual language designed for Malaysian corporate agreements:

### SCHEDULE B: SERVICE LEVEL AGREEMENT (SLA) & OPERATIONAL COMMITMENTS

1. SERVICE AVAILABILITY COMMITMENT
1.1 The Service Provider guarantees an operational Uptime Availability of 99.9% across any 
    calendar month, excluding Pre-Approved Scheduled Maintenance Windows.
1.2 Scheduled Maintenance shall occur exclusively between 01:00 AM and 05:00 AM Malaysia Time (MYT) 
    and requires a minimum of forty-eight (48) hours prior written notice to the Client.

2. INCIDENT MANAGEMENT & ESCALATION
2.1 In the event of a Severity Level 1 (P1 - Critical Outage), the Service Provider shall acknowledge 
    receipt within thirty (30) minutes and initiate active remediation by a senior systems engineer.
2.2 Status updates during a P1 incident shall be communicated to the Client's Designated Technical Contact 
    via instant messaging (WhatsApp/Slack) and email at intervals not exceeding sixty (60) minutes until resolution.

3. DATA PROTECTION & ASSET OWNERSHIP GUARANTEE
3.1 The Client retains 100% sole and unencumbered legal ownership of all domain names (.my/.com), 
    DNS zones, source code repositories, databases, media assets, and server credentials.
3.2 The Service Provider shall not withhold administrative credentials, DNS records, or auth codes (EPP) 
    for any reason, including commercial disputes, which shall be resolved independently of operational custody.
3.3 All personal data collected through the web estate shall be processed strictly in accordance with 
    the Personal Data Protection Act 2010 (PDPA) of Malaysia.

---

Common Loopholes in Low-Cost Agency Maintenance Contracts

When reviewing maintenance proposals from conventional agencies in Malaysia, look out for these common warning signs:

1. No Distinction Between Response Time and Resolution Time: An agency might advertise "15-minute response time", which simply means an automated bot sends an auto-reply ticket, while real human repair work doesn't begin for 3 days.
2. Exclusion of Plugin Incompatibilities: Many contracts state that issues caused by "third-party plugins" are excluded from maintenance and billed at exorbitant hourly rates.
3. Holding Domain & DNS Hostage: Unscrupulous agencies register the client's .MY domain under the agency's own MYNIC username, preventing the client from switching providers without paying a hefty "release fee".

---

Enterprise Governance with JagaWeb

At JagaWeb, we believe enterprise-level accountability should not be reserved exclusively for conglomerates with six-figure budgets. We deliver transparent, contractually backed SLA performance for businesses across Malaysia—including Daralwahi, Agros Empire, UrusHQ, nCrypt, Trexon Energy, and TechFix Malaysia.

Our Transparent Maintenance Pricing:

• Ownership & Access Review: RM5,000 fixed (system audit, complete credential recovery, architecture lockdown).
• Managed Care Plan: RM450/month (formal P1-P4 SLA, 3-2-1 offsite backups, Cloudflare WAF, staged updates, 1-hour critical response).
• Monthly System Improvement: From RM13,000/month (dedicated monthly engineering capacity for new features and optimizations).
• Fixed-Scope Re-Architecture: From RM30,000 (bespoke enterprise builds).

Secure an Enterprise SLA with JagaWeb and establish true legal and technical certainty for your digital assets.