Service Level Agreement · v1.0

Service Level Agreement.

What we commit to. What you’re entitled to. How we operate.

v1.0·Effective 2026-06-01·Author: Ricardo Gamon

Breach disclosure

72h

Section 01 · Security

Breach disclosure.

These commitments match the public posture at /security and the live attack log at /awais/incidents.

Confirmed breach disclosure to affected customers72 hours

Why 72 hours on disclosure

72-hour breach disclosure matches what is on /security, what is on /awais/red-team, and what the FTC Safeguards Rule (as amended 2023) requires for any incident affecting 500+ consumers. We publish the same number to everyone: customers, regulators, press.

Section 02 · Data

Backups, export, and what happens at the end.

Your data belongs to you. The platform’s job is to never be the reason you cannot leave.

Backup frequency (Supabase point-in-time recovery)15-minute intervals

Data export on customer request24 hours

Export formatNative Postgres / CSV

Account-closure data return30 days · no fee

Default retention after closure90 days then full purge

Extended retention on customer requestAs specified, no charge

Account-closure return is not extraction

We do not charge for exports, not at signup, not at renewal, not at termination. There is no “data extraction fee” anywhere in our pricing, ever.

Section 03 · AI & model

What we guarantee about the models. What we don’t.

Gladius runs a third-party AI model provider as the primary model tier. Some things about that are guaranteed; some things are not, and we do not pretend otherwise.

Model uptime

Inherits the upstream provider’s SLA. When the provider is up, we are up against their number; when it is down, we route through the fallback below.

Model fallback (automatic)

When the primary model is unavailable, we silently fall back to the next tier, a lower-cost tier, with no customer action required. The fall is logged and surfaced on /status.

Model accuracy

We do not guarantee AI output quality. High-stakes outputs (desking, F&I, and customer communication) route through human review. An operator does not delegate the close to a chatbot, and neither does our platform.

Section 04 · Exclusions

What this SLA does not cover.

Honest carve-outs. None of these are loopholes. They are things genuinely outside our control or outside the scope of a standard contract.

01Customer-caused outages. Misconfiguration in the dealer admin panel, credential leak from your side, deliberate abuse, or unsanctioned integration work.
02Third-party outages outside our control. Vercel, Supabase, Twilio, Resend, Stripe, our AI model provider, and similar. We mitigate (fallbacks, retries, status feeds) but we do not insure third-party availability.
03Force majeure. Acts of war, natural disasters, regulator-ordered shutdown, internet infrastructure failure at a national-backbone scale.
04Custom enterprise contracts. A signed enterprise MSA may override these defaults in either direction. When that happens, the MSA controls and this page documents the standard floor.

Section 05 · SLA changes

How and when we change this document.

→All changes published 30 days in advance via /changelog.
→Material reductions (longer response windows, longer disclosure windows, narrower scope) trigger explicit customer notice and a 30-day termination right without penalty.
→Material improvements (faster response, broader scope, stronger guarantees) are effective immediately, with no waiting period.
→Previous versions are archived and available on request.

Current version

v1.0·Effective 2026-06-01·Author: Ricardo Gamon

Direct contact

Who to email for what.

SLA questions: legal@gladiuscrm.com
Billing questions: billing@gladiuscrm.com
Critical-issue escalation: 813-442-0253
Founder · LinkedIn: Ricardo Gamon →

Live platform telemetry lives at /status. Severity definitions live at /support. Security posture lives at /security. Changes to this SLA are published 30 days in advance at /changelog.

Gladius

Breach disclosure.

These commitments match the public posture at /security and the live attack log at /awais/incidents.

Confirmed breach disclosure to affected customers72 hours

Why 72 hours on disclosure

Backups, export, and what happens at the end.

Your data belongs to you. The platform’s job is to never be the reason you cannot leave.

Backup frequency (Supabase point-in-time recovery)15-minute intervals

Data export on customer request24 hours

Export formatNative Postgres / CSV

Account-closure data return30 days · no fee

Default retention after closure90 days then full purge

Extended retention on customer requestAs specified, no charge

Account-closure return is not extraction

We do not charge for exports, not at signup, not at renewal, not at termination. There is no “data extraction fee” anywhere in our pricing, ever.

What we guarantee about the models. What we don’t.

Gladius runs a third-party AI model provider as the primary model tier. Some things about that are guaranteed; some things are not, and we do not pretend otherwise.

Model uptime

Inherits the upstream provider’s SLA. When the provider is up, we are up against their number; when it is down, we route through the fallback below.

Model fallback (automatic)

When the primary model is unavailable, we silently fall back to the next tier, a lower-cost tier, with no customer action required. The fall is logged and surfaced on /status.

Model accuracy

What this SLA does not cover.

Honest carve-outs. None of these are loopholes. They are things genuinely outside our control or outside the scope of a standard contract.

01Customer-caused outages. Misconfiguration in the dealer admin panel, credential leak from your side, deliberate abuse, or unsanctioned integration work.

02Third-party outages outside our control. Vercel, Supabase, Twilio, Resend, Stripe, our AI model provider, and similar. We mitigate (fallbacks, retries, status feeds) but we do not insure third-party availability.

03Force majeure. Acts of war, natural disasters, regulator-ordered shutdown, internet infrastructure failure at a national-backbone scale.

04Custom enterprise contracts. A signed enterprise MSA may override these defaults in either direction. When that happens, the MSA controls and this page documents the standard floor.

How and when we change this document.

→All changes published 30 days in advance via /changelog.

→Material reductions (longer response windows, longer disclosure windows, narrower scope) trigger explicit customer notice and a 30-day termination right without penalty.

→Material improvements (faster response, broader scope, stronger guarantees) are effective immediately, with no waiting period.

→Previous versions are archived and available on request.

Current version

v1.0·Effective 2026-06-01·Author: Ricardo Gamon

Who to email for what.

Live platform telemetry lives at /status. Severity definitions live at /support. Security posture lives at /security. Changes to this SLA are published 30 days in advance at /changelog.