1. Scope
This Service Level Agreement ("SLA") governs availability, performance, security, incident response, and data handling for the Flowpoint platform.
It covers B2B invoice certification, B2C reporting, bulk processing, credit and debit notes, compliance review, webhooks, audit logs, data export, and sandbox and production environments. It does not cover tax advice, legal interpretation of NRS rules, or general ledger accounting.
- Customers must maintain a valid NRS-registered TIN and current cryptographic keys and certificates.
- Invoice payloads and connected accounting software must meet Flowpoint's current specifications; customers must stay within published rate limits and report suspected incidents or data breaches within 24 hours.
2. Availability
Production availability is measured over a rolling 30-day period. Scheduled maintenance, NRS MBS outages, customer-caused issues, and third-party failures outside Flowpoint's reasonable control are excluded.
- Credit requests must be emailed to [email protected] within 30 days of the incident.
- Credits apply to the following month's invoice and exclude sandbox and NRS-caused outages.
| Metric | Target |
|---|---|
| Monthly uptime | ≥ 99.9% (≤ 43.2 minutes downtime / month) |
| Planned maintenance | ≤ 4 hours / month; ≥ 72 hours' notice; weekends, 01:00–05:00 WAT |
| Sandbox environment | Best-effort; not covered by uptime SLA |
| Monthly Uptime | Service Credit |
|---|---|
| ≥ 99.9% | None |
| 99.0%–99.89% | 10% of that month's fee |
| 95.0%–98.99% | 25% of that month's fee |
| < 95.0% | 50% of that month's fee |
3. Performance
Under normal load, standard API requests range from about 200 ms at p50 to 1,500 ms at p99; invoice submission is up to 4 seconds at p99 excluding NRS MBS latency.
Production capacity is 500 invoice submissions per second sustained and 2,000 per second in bursts. Rate limits use a 1-minute window and expose RateLimit-* headers; exceeding them returns HTTP 429 — use exponential backoff.
- create-bulk and bulk-submit accept up to 500 invoices per call; a batch of 500 completes within 10 minutes at p99.
- Webhook callbacks must return HTTP 2xx within 10 seconds. Delivery is at-least-once; failed deliveries retry up to five times (~5s, ~10s, ~20s, ~40s), then the endpoint is paused until re-enabled.
- Failed NRS submissions can be retried with POST /api/v1/invoices/{id}/retry or POST /api/v1/transmissions/retry-bulk.
| Invoice Stage | Target |
|---|---|
| Draft and local validation | < 2 seconds |
| NRS submission | < 30 seconds, excluding NRS MBS latency |
| Signed and cleared | < 60 seconds end-to-end, excluding NRS MBS latency |
| Rejected | Error shown within 5 seconds |
| B2C reporting | Every 15 minutes within the 24-hour window; alert at 20 hours |
| Scope | Limit |
|---|---|
| Authentication (/api/v1/auth/*), per IP | 10 requests/minute |
| All other /api/v1/*, per IP | 120 requests/minute |
| POST /api/v1/invoices/create, per tenant | 60 requests/minute |
| Bulk create and upload routes, per tenant | 5 requests/minute |
4. Security and Data
Customer data is hosted with enterprise cloud infrastructure providers under contractual data-protection terms. The production database is encrypted at rest and backed up daily, with backups retained for 7 days and point-in-time recovery. Where data is processed outside Nigeria, Flowpoint relies on the safeguards the Nigeria Data Protection Act 2023 requires. Material storage or backup changes are notified in writing within 5 business days.
Flowpoint designs its controls around the Nigeria Data Protection Act 2023 and the NRS e-invoicing requirements. A summary of current security controls is available on request.
- Encryption: TLS in transit with HSTS; the database, cache and backups are encrypted at rest; customer NRS keys and secrets are additionally encrypted by Flowpoint before storage.
- Access: two-step sign-in with an emailed one-time code; role-based permissions with optional location limits; accounts by invitation only; 24-hour sessions.
- Isolation: invoice data, keys, mappings, and tokens are scoped by tenant ID on every query path.
- Retention: certified invoice audit records and NRS responses are retained for 7 years. Customers can export their invoice data at any time through the portal (CSV) or the API.
- Termination: data remains read-only and export-accessible for 60 days, then archived for the remainder of the 7-year retention period.
5. Incidents and Support
Flowpoint provides an incident ID and owner at initial response. During a P0 or P1 incident, affected customers receive email updates until it is resolved.
| Severity | Impact | Response | Target |
|---|---|---|---|
| P0 — Critical | Platform unavailable | ≤ 15 min | ≤ 2 hours |
| P1 — High | Multi-tenant submission or database failure | ≤ 30 min | ≤ 4 hours |
| P2 — Medium | Single-tenant or non-critical issue | ≤ 2 hours | Next business day |
| P3 — Low | Cosmetic or documentation issue | ≤ 1 business day | Next sprint |
| Channel | Availability |
|---|---|
| Contact form | app.tryflowpoint.com/contact-support — 08:00–20:00 WAT, Monday–Friday |
| [email protected] for P2/P3 | |
| 24/7 on-call | P0/P1 outside business hours |
6. Liability and Changes
Flowpoint may update this SLA with 30 days' written notice; changes will not reduce commitments during the current calendar quarter.
Service credits are the customer's sole remedy for availability failures. Flowpoint's liability in any calendar month is limited to the fees paid for that month, with no liability for indirect, consequential, or punitive damages arising from service interruptions.