AEGIX Trust Center
Aegix Global, LLC

Service Level Agreement

Aegix Platform — Safety and Incident Management · Effective January 1, 2025 · Last reviewed 2026-09-20

Last reviewed 2026-09-20

The Aegix platform includes three client applications: Aegix One (parent and student safety communications and check-in), Aegix AIM (on-site staff and emergency responder incident management, mapping, and coordination), and Aegix SMS (SIS integrations, reunification management, visitor management, and on-site administration). This SLA covers all platform services, integrations, and client applications.

Effective January 1, 2025

1. AGREEMENT OVERVIEW

This Service Level Agreement (“SLA”) is entered into between Aegix Global, LLC, a Utah limited liability company (“Provider”), and an organization that subscribes to the Aegix platform (the “Authorized Customer” or “Customer”) to define the terms of service delivery, performance standards, and support for the Aegix platform.

Parties and Purpose

  • Provider: Aegix Global, LLC, 94 Lone Hollow Dr., Sandy, UT 84092

  • Customer: Subscribing organization. Examples include K-12 Local Education Agencies and charter networks; colleges and universities; federal, state, local, tribal, and military government agencies; hospitals, clinics, and health systems; corporate, religious, summer-camp, sports, and entertainment-venue site operators; and other organizations operating physical sites that require real-time safety communication and incident management.

  • Service: Cloud-hosted SaaS delivery of the Aegix platform for safety communication, incident management, indoor and outdoor mapping, push-notification delivery, reunification, visitor management, and (where the Authorized Customer has enabled it) Digital 911 Routing to certified public-safety dispatch providers.

  • Governance: This SLA operates in conjunction with the applicable Student Data Privacy Agreement (DPA) and the executed Master Subscription Agreement (../customer-portal/master-subscription-agreement.md)

Effective Date and Renewal

  • Effective Date: This SLA is effective upon the date of execution by both parties

  • Renewal: This SLA renews automatically on an annual basis unless terminated in writing at least 60 days prior to renewal date

2. SERVICE DESCRIPTION

Aegix platform is a cloud-native safety and incident-management platform delivered as a Software-as-a-Service (SaaS) solution. The Service includes:

  • Safety communication system for emergency alerts, incident notifications, and two-way messaging across the Authorized Customer’s site or sites

  • Incident management workflow for documenting, tracking, and responding to safety incidents

  • Indoor and outdoor mapping integration for location-aware safety responses

  • Push notification capabilities via certified delivery infrastructure

  • Reunification, visitor-management, and on-site administrative functions appropriate to the Authorized Customer’s sector

  • Web and mobile applications accessible via modern browsers and iOS / Android platforms

  • Data processing in compliance with applicable privacy laws, including (where the Authorized Customer’s sector triggers them) FERPA, COPPA, the SDPC v3 16-state Data Privacy Agreement framework for K-12, FedRAMP-environment controls for government, and the BAA-on-request HIPAA pathway for healthcare

3. SERVICE AVAILABILITY & UPTIME

Uptime Commitment

Provider commits to a Monthly Uptime Percentage of at least 99.9% in each calendar month, calculated as set out under Uptime Calculation below, excluding noticed Standard Maintenance Windows and force majeure events.

Critical safety features (emergency alerts, incident reporting) are targeted at 99.99% availability during the Authorized Customer’s Operating Hours to ensure reliability when safety needs are greatest.

Operating Hours Definition

“Operating Hours” are defined by sector. The default for K-12 and higher-education Authorized Customers is 6:00 AM to 8:00 PM local time, Monday through Friday, during the Authorized Customer’s published academic calendar (excluding scheduled closures, holidays, and summer breaks). For healthcare Authorized Customers, Operating Hours are 24 hours per day, every day. For government Authorized Customers, Operating Hours follow the Authorized Customer’s published business hours unless the Order Form specifies otherwise (e.g., 24/7 for emergency-services agencies). For corporate, religious, summer-camp, sports, entertainment-venue, and other site-operating Authorized Customers, Operating Hours are as specified in the Order Form, defaulting to the Authorized Customer’s published site hours. References elsewhere in this SLA to “School Hours” are deemed to mean “Operating Hours” as defined here for non-K-12 / non-higher-education Authorized Customers.

Uptime Calculation

Uptime is measured from the request and error counters of Provider’s production load-balancing tier, which receives requests to the Service from the Authorized Customer’s users and applications before they reach Provider’s application servers.

  • “Measurement Interval” means each consecutive five-minute period in a calendar month, measured in Coordinated Universal Time (UTC).

  • “Valid Request” means a request to the Service that reaches Provider’s production load-balancing tier.

  • “Failed Request” means a Valid Request for which the load-balancing tier returns a server error (HTTP 5xx) because the Service was unable to process it, including HTTP 502 (Bad Gateway), 503 (Service Unavailable), and 504 (Gateway Timeout). An error returned by the application in response to a particular request, such as a defect in a single feature, is handled as a support incident under Section 5 and is not a Failed Request.

  • “Interval Error Rate” means the number of Failed Requests divided by the number of Valid Requests in a Measurement Interval. A Measurement Interval during which the Service is unreachable because of a Provider-side outage, such that Valid Requests cannot be received or recorded, has an Interval Error Rate of 100%.

The Monthly Uptime Percentage is calculated using the following formula:

Monthly Uptime Percentage = 100% − (Sum of Interval Error Rates ÷ Number of Measurement Intervals in the Month)

Measurement Intervals falling wholly within a Standard Maintenance Window for which the 72-hour advance written notice was given are excluded from both the sum and the count. Emergency Maintenance is never excluded: Measurement Intervals affected by Emergency Maintenance remain in the calculation. Requests that do not reach Provider’s load-balancing tier because of the Authorized Customer’s or a user’s network, device, browser, or local connectivity are not Valid Requests and do not affect the calculation.

Provider calculates the Monthly Uptime Percentage after the end of each calendar month and retains the calculation and its supporting interval data for no less than 24 months.

Scheduled Maintenance

  • Standard Maintenance Windows: Weekends (Saturday–Sunday) or after 10:00 PM local time, with 72-hour advance written notice

  • Emergency Maintenance: Critical security patches and urgent infrastructure repairs may occur anytime with best-effort advance notice (minimum 4-hour notice when possible)

  • Maintenance Exclusion: Only Standard Maintenance Windows for which the 72-hour advance written notice was given are excluded from uptime calculations. Emergency Maintenance is included in uptime calculations and does not limit service-credit eligibility

4. SERVICE CREDIT SCHEDULE

If the Monthly Uptime Percentage falls below 99.9%, Customer is eligible for service credits applied to the next billing cycle. Credits are the sole and exclusive remedy for downtime.

Monthly Uptime PercentageService Credit
99.0% – 99.9%5% of monthly service fees
95.0% – 99.0%10% of monthly service fees
Below 95.0%25% of monthly service fees

Credit Claim Process

  • Credits must be requested in writing within 30 days of the month in which the outage occurred

  • Provider will validate the Monthly Uptime Percentage using the retained interval data described in Section 3

  • Credits are applied automatically to the next month’s invoice within 10 business days of verification

  • Credits do not apply to noticed Standard Maintenance Windows excluded under Section 3, force majeure events, or Customer-side connectivity issues

5. INCIDENT RESPONSE & SUPPORT TIERS

Provider operates a staffed support desk during Support Hours, with tiered response based on incident severity. All incidents reported during the Authorized Customer’s Operating Hours receive prioritized handling.

The Service itself operates continuously. Emergency alerting, incident reporting, and notification delivery are always-on platform functions and are not limited to Support Hours. Support Hours govern Provider’s human support response, not platform availability.

“Support Hours” means Monday through Friday, 8:00 AM to 6:00 PM Mountain Time, excluding Provider-observed United States holidays. Response Times are measured from Provider’s receipt of the report and are counted in Support Hours.

PriorityDefinitionResponse TimeCoverage
P1 CriticalSafety system outage or confirmed data breach1 hourSupport Hours; a P1 received outside Support Hours is acknowledged at the start of the next Support Hours period
P2 HighMajor feature degradation or suspected unauthorized access4 hoursSupport Hours
P3 MediumMinor feature issue or non-critical bug8 hoursSupport Hours; next-business-day resolution target
P4 LowCosmetic issues or feature requestsNext business daySupport Hours

Provider does not currently offer 24/7/365 support coverage or a continuous after-hours support line. Authorized Customers requiring continuous after-hours human response for P1 incidents should engage Provider on scope; any such coverage is specified in the Order Form.

Support Channels

  • Email Support: support@aegix.global (standard inquiries and P3/P4 tickets)

  • Web Portal: Self-service ticketing at aegix.global/support

  • Phone Support: 888.691.0699, Monday through Friday, 8:00 AM to 6:00 PM Mountain Time

6. DATA SECURITY COMMITMENTS

Provider implements a comprehensive, defense-in-depth security architecture aligned with NIST SP 800-53 Rev 5 and industry best practices appropriate to the Authorized Customer’s sector — K-12, higher education, government, healthcare, or other regulated environments.

Encryption

  • Data at Rest: AES-256 encryption for all stored student and operational data

  • Data in Transit: TLS 1.2 or higher for all network communications

Cloud Infrastructure

  • Primary Infrastructure: AWS with multi-AZ deployment across US regions

  • AWS Security Services: GuardDuty (threat detection), CloudTrail (audit logging), Security Hub (security posture), CloudWatch (monitoring), Inspector (vulnerability assessment), KMS (encryption key management)

  • Network Security: VPC isolation, WAF protection, DDoS mitigation (Shield Standard), CloudFront CDN with WAF rules

  • Secondary Services: GCP used exclusively for outdoor mapping and push notification delivery

Compliance and Audits

  • NIST Alignment: Controls aligned with NIST SP 800-53 Rev 5

  • Penetration Testing: Annual third-party penetration testing and vulnerability assessments

  • SOC 2 Type II: Audit in progress; results will be provided to Customers upon completion

  • Data Residency: All data resides in United States AWS regions; no international transfers without explicit DPA amendment

  • Logical Isolation: Multi-tenant architecture with role-based access controls (RBAC) and database-level data isolation

Backup and Redundancy

  • Automated Backups: Daily automated backups with 30-day retention

  • Point-in-Time Recovery: Capability to restore data to any point within the last 30 days

  • Multi-AZ Replication: AWS multi-AZ replication for automatic failover and redundancy

7. SECTOR-SPECIFIC REGULATORY COMPLIANCE

Provider has implemented policies and technical controls to comply with the universal privacy posture described in the Aegix Privacy Policy (CPRA, VCDPA, CPA, CTDPA, TDPSA, OCPA, and analogous state comprehensive privacy laws), and with sector-specific obligations triggered by the type of organization the Authorized Customer is. Data processing is limited to the purposes contracted in the Order Form and the executed sector-specific addendum (SDPA, BAA, or other), and to security, fraud-prevention, and legal-compliance purposes.

Universal Restrictions (apply to all Authorized Customers)

  • No Sale: Customer Data is never sold to third parties

  • No Commercial Use: Customer Data is not used for commercial purposes, behavioral profiling, or market research outside the contracted Service

  • No Targeted Advertising: Customer Data is not used for targeted advertising or marketing

  • Limited Processing: Data processing is strictly limited to the contracted purposes

  • Subprocessor governance: All subprocessors with access to Customer Data are listed in the Subprocessor List and bound by contract to obligations equivalent to those in this SLA

K-12 and youth-serving Authorized Customers

  • FERPA (20 U.S.C. § 1232g): Provider operates as a “school official” with legitimate educational interest; no disclosure of student records without Authorized Customer authorization

  • COPPA (15 U.S.C. § 6501–6506): Parental consent for children under 13 is managed through the Authorized Customer; Provider does not collect independent consent

  • 16-State SDPC v3 Coverage: Student data is protected under all applicable state Student Data Privacy Agreements where the Authorized Customer operates, including MA, ME, CO, IL, IA, MO, NE, NH, NJ, NY, OH, RI, TN, VT, VA, and WA

  • NY Education Law § 2-d & 8 NYCRR Part 121: Compliance with NY student data governance requirements where the Authorized Customer operates schools subject to NY § 2-d

  • State-Specific Requirements: Timely notification, data destruction timelines, and breach remediation per applicable state student-data-privacy law

  • DPA Governance: All Student Data processing is governed by the applicable Student Data Privacy Agreement executed between Provider and the K-12 Authorized Customer

Higher-education Authorized Customers

  • FERPA: Applies to higher-education student records; Provider operates as a “school official” with legitimate educational interest when processing student records on behalf of a higher-education Authorized Customer that has so designated Provider in writing

  • State student-data-privacy laws may apply where the Authorized Customer’s enrollment includes minors

Government Authorized Customers (federal, state, local, tribal, military)

  • FedRAMP environment: Provider’s cloud infrastructure operates within Amazon Web Services environments authorized at the FedRAMP Moderate impact level; the Aegix Service itself is not FedRAMP-authorized as of the Effective Date. Government Authorized Customers requiring full FedRAMP Moderate or High Service-level authorization should engage Provider on roadmap and scope

  • FISMA: Provider’s security controls are aligned with NIST SP 800-53 Rev 5 in accordance with FISMA expectations for the Moderate impact level

  • CJIS: Where the Authorized Customer is a law-enforcement agency or operates within a CJIS-regulated workflow, Provider will reasonably cooperate with CJIS-driven configuration and access-control needs

  • FOIA / public-records cooperation: Provider will reasonably assist Government Authorized Customers with FOIA-driven data-export requests, subject to the executed contract

Healthcare Authorized Customers

  • HIPAA / PHI: The Service is not designed to process PHI as a primary record system and is not HIPAA-authorized in its default configuration. Healthcare Authorized Customers must not transmit PHI through the Service unless and until a Business Associate Agreement (“BAA”) is executed between Provider and the Authorized Customer. Provider will execute a BAA on request from a covered entity or business associate

  • State health-privacy laws (CMIA, MHMD, analogous regimes) — applicability determined per Authorized Customer

Other Site-Operating Authorized Customers (corporate, religious, summer-camp, sports / entertainment venue, etc.)

  • The universal posture above applies in full

  • Sector-specific obligations are the responsibility of the Authorized Customer to identify and configure for; Provider will reasonably assist with technical configuration as part of the executed contract

  • Where the Authorized Customer enrolls minors (e.g., a summer camp serving children under 13, a youth sports program), the K-12 / youth-serving provisions above apply by analogy

8. DATA BREACH NOTIFICATION

In the event of a confirmed or suspected security breach involving Customer Data, Provider will notify Customer immediately and provide comprehensive support for breach remediation. Specific notification timelines depend on the Authorized Customer’s sector and applicable law.

Notification Timeline

  • Standard Notification (all Authorized Customers): Within 72 hours of discovery of the breach

  • Virginia Expedited: Within 24 hours where Virginia state law applies

  • K-12 Authorized Customers — NY Education Law § 2-d: Notification within 60 calendar days with Customer-approved remediation plan, subject to law-enforcement-delay provisions

  • Healthcare Authorized Customers under executed BAA: HIPAA Breach Notification Rule timelines apply (without unreasonable delay, no later than 60 days from discovery)

  • Government Authorized Customers: Agency-specific timelines per the executed contract; for federal agencies, FISMA / OMB M-22-01 incident-reporting cooperation is the default

  • Post-Incident Report: Detailed technical report within 30 days of resolution

Notification Content

  • Nature of the breach and data affected

  • Number of individuals and records involved

  • Remediation steps taken and in progress

  • Contact information for Provider’s privacy and security team

  • Cooperation Plan: Provider’s commitment to assisting Customer with notification to parents/guardians

9. BACKUP & DISASTER RECOVERY

Provider maintains a comprehensive backup and disaster recovery program to minimize data loss and ensure rapid service restoration in the event of infrastructure failure.

Recovery Objectives

MetricNon-Critical ServicesCritical Services
RPO (Recovery Point Objective)1 hour1 hour
RTO (Recovery Time Objective)24 hours4 hours

Backup and Testing

  • Backup Frequency: Automated daily backups

  • Retention: 30-day backup retention with incremental snapshots

  • Disaster Recovery Testing: Annual DR testing with documented results

  • Transparency: Test results and DR plan are available to Customer upon request

10. CHANGE MANAGEMENT

  • Material Service Changes: 30-day advance written notice via email to designated Customer contact

  • Data Processing Changes: Changes affecting Customer Data processing require amendment of the executed sector-specific addendum (SDPA / BAA / DPA / equivalent) and Customer acknowledgment

  • Security Patches: Emergency security patches are exempt from advance notice but will be communicated as soon as practicable

  • Feature Deprecation: Deprecated features will have at least 180 days notice with migration guidance

11. TERMINATION & DATA HANDLING

Data Export

  • Format: Customer data is available for export in standard, non-proprietary formats (CSV, JSON)

  • Timeline: Available within 30 days of written request

Data Destruction

  • Timelines: Destruction timelines comply with applicable state law requirements:

    1. NY: 90 calendar days

    2. IL, CO: 30 calendar days

    3. Other states: Per applicable DPA

  • Methods: NIST SP 800-88 Rev 1 compliant destruction methods, including cryptographic erasure

  • Certification: Written certification of destruction provided upon completion

12. SERVICE REPORTING

  • Monthly Uptime Reports: Available upon request with detailed availability metrics

  • Quarterly Security Summaries: Overview of security assessments, penetration test results, and remediation status

  • Annual Compliance Attestation: Documentation of compliance with applicable sector-specific privacy laws (FERPA, COPPA, and state student-data-privacy laws for K-12 Authorized Customers; FedRAMP / FISMA posture for government Authorized Customers; HIPAA posture-on-BAA for healthcare Authorized Customers; CPRA and analogous comprehensive state privacy laws for all)

  • Incident Reports: Detailed reports for any P1/P2 incidents within 5 business days

Availability Incident Communication

Separately from the security-breach obligations in Section 8, Provider communicates service-availability incidents as set out below. An “Availability Incident” means any period of 15 minutes or more (three consecutive Measurement Intervals) in which the Interval Error Rate defined in Section 3 is 5% or more, or any Measurement Interval in which the Service is unreachable because of a Provider-side outage. Availability Incidents are classified P1 through P4 using the severity definitions in Section 5.

  • Incident Record: Provider opens an internal incident record for every Availability Incident at the time of detection, regardless of duration or time of day, and retains it for no less than 24 months. The record is available to the Authorized Customer on request.

  • Initial Notice: For a P1 or P2 Availability Incident, Provider notifies the Authorized Customer’s designated administrative contacts within 2 hours of Provider becoming aware, or at the start of the next Support Hours period where awareness occurs outside Support Hours. The initial notice states what is affected, what is not affected, and when the next update will be issued.

  • Interim Updates: At least every 4 hours during Support Hours while a P1 or P2 Availability Incident remains unresolved, and on any material change in scope or expected restoration time.

  • Resolution Notice: Within 1 business day of restoration and verification.

  • Post-Incident Report: For any P1 or P2 Availability Incident, a written report within 5 business days of restoration, stating impact, start and end times, duration, root cause, and corrective actions taken or planned. This is the Incident Reports commitment above, applied to availability.

  • Proactive Uptime Disclosure: Where a calendar month falls below the uptime commitment in Section 3, Provider discloses that in the monthly uptime report for that month and identifies the contributing incidents, without requiring the Authorized Customer to request it. This disclosure is independent of the Authorized Customer’s service-credit claim under Section 4.

13. ESCALATION PROCEDURES

Provider operates a multi-level escalation process to ensure rapid resolution of critical incidents.

LevelRoleTriggerAction
1Support TeamInitial incident reportTriage, diagnose, attempt resolution
2Engineering LeadUnresolved P1/P2 after 4 hoursEngineering assessment and remediation
3CPTOUnresolved P1 after 8 hoursExecutive oversight and resource allocation
4CEOCritical incident unresolved 24+ hoursStrategic decision-making and external coordination

Data Privacy Concerns

  • For data protection and privacy concerns, Customer may contact Provider’s designated Privacy Officer at privacy@aegix.global

14. LIMITATIONS & EXCLUSIONS

This SLA does not apply to, and service credits are not available for, downtime or performance issues caused by:

  • Customer’s internet connectivity, network, or firewall issues

  • Customer-modified integrations, customizations, or unsupported configurations

  • Third-party service outages (including Apple Push Notification Service, Google Cloud Messaging, or other external vendors)

  • Force majeure events (natural disasters, war, public health emergencies, government actions)

  • Standard Maintenance Windows for which the 72-hour advance written notice required by Section 3 was given (Emergency Maintenance is not excluded)

  • Customer’s misuse or violation of the Acceptable Use Policy, End User License Agreement, or Master Subscription Agreement

Remedy Limitations

  • Service credits are the sole and exclusive remedy for any service availability or performance issues. In no event shall Provider be liable for indirect, incidental, or consequential damages.

15. AGREEMENT SIGNATURES

This Service Level Agreement is executed by and between the parties as of the date last signed below.

AEGIX GLOBAL, LLC

By: _____________________________________________

Name: _____________________________________________

Title: _____________________________________________

Date: _____________________________________________

LOCAL EDUCATION AGENCY (CUSTOMER)

By: _____________________________________________

Name: _____________________________________________

Title: _____________________________________________

Organization: _____________________________________________

Date: _____________________________________________

Appendix: Vendor Compliance Documentation References

The following vendor documentation provides supporting evidence for the compliance claims and technical controls referenced in this document. These resources should be reviewed periodically to ensure alignment with current vendor certifications and capabilities.

Amazon Web Services (AWS)

Cloud Management Platform (DuploCloud)

Note: AWS compliance reports (SOC 2 Type II, ISO 27001) are available for download through AWS Artifact in the AWS Management Console. Contact the CPTO for access credentials.

View this document’s source in Git ↗