Service Description IBM Sterling B2B Services This Service Description describes the Cloud Service IBM provides to Client. Client means the company and its authorized users and recipients of the Cloud Service. The applicable Quotation and Proof of Entitlement (PoE) are provided as separate Transaction Documents 1. Cloud Service 1.1 IBM Sterling B2B Services IBM Sterling B2B Service is a cloud-based, business-to-business (B2B) integration-as-a-service solution providing connectivity and collaboration between Client and customers, suppliers, and the organizational entities with which Client has a business relationship ( Trading Partners ). Client s Trading Partners are organizational entities with which Client has a business relationship. The Cloud Service is based upon a value added network (VAN) known as the IBM Sterling B2B Collaboration Network. The Cloud Service delivers visibility and control over the business processes shared with outside companies and can provide onboarding and community support for a Client s Trading Partners. The main component of the Cloud Service is Transport. The Cloud Service provides connectivity and collaboration with Trading Partners and delivers visibility and control over the business processes shared with outside companies. The Cloud Services include, but are not limited to, data transport, carbon copy, delimiter conversion, document clipping, and First-In-First-Out (FIFO) processing. IBM will establish the hardware, software, and communications for the Cloud Service. Client and IBM each retain responsibility for access control, firewalls, user security, and hardware at their respective network entry point. As part of this Cloud Service, IBM will implement connectivity between Client and IBM and will work with Client during joint connectivity testing between Client and IBM. As further set forth on the Transaction Document, IBM will provide Mailboxes on the IBM B2B Collaboration Network, each of which is a private, electronic storage space that is assigned to Client, allowing Client to send, store, and receive electronic data. Client may also choose to use Mailslots, which are components of a Mailbox that allows the drop off and pick up of data. IBM will retain and provide on-line visibility to data which is 0-35 days old, via browser-based visibility tools. After 35 days Client will no longer have access to the data because it will be purged. The Cloud Service will enable Client to input and manage content containing information which may be considered personal information (PI) under applicable privacy laws including contact information (name, address, email, phone number, staff ID, cost center) and technical identifiers (username, password, IP addresses, MAC addresses). IBM will comply with requests from Client, its employees, or Guest Users to access, update, correct or delete such personal information. This Cloud Service is not designed to any specific security requirements for sensitive personal information, protected health information, or other regulated content. Client is responsible to determine if this Cloud Service meets Clients needs with regard to the type of content Client uses in connection with the Cloud Service. Under no circumstances may Client use this Cloud Service to collect, process or store protected health information. 1.2 Optional Services 1.2.1 Premium Support Services This optional support offering provides a dedicated team of assigned resources to be available for Client s support issues over and above our basic technical support. This Cloud Service is only available in North America. 1.2.2 Networking Options a. Collaboration Network Co-Managed VPN Subscription: consists of a connection to the IBM B2B Collaboration Network via Client s VPN connection. 1.2.3 Set-Up Services for Networking Options Set-up services will be provided to a Client owned or controlled location or an IBM location, as applicable. a. IBM Sterling B2B Services Collaboration Network - Co-Managed VPN Set-up: consists of working with Client to configure Client s VPN to connect to the IBM B2B Collaboration Network. i126-6371-03 (11/2015) Page 1 of 7
b. IBM Sterling B2B Services Collaboration Network - Managed AS2 Set-up: consists of configuring Client s managed AS2 connection to the IBM B2B Collaboration Network. c. IBM Sterling B2B Services Collaboration Network - OFTP2 Set-up: consists of provisioning OFTP2 to connect to the IBM B2B Collaboration Network. 1.2.4 Community Services a. IBM Sterling B2B Services - Community Development Services - Standard Partner Survey consists of sending an existing survey template to collect data about EDI capabilities and plans to Client s Trading Partners. Client must provide a Trading Partner list. b. IBM Sterling B2B Services Community Development Services - Custom Partner Survey consists of assembling and sending a survey to collect data from Client s Trading Partners. Client must define the questions to be asked and provide a Trading Partner list. c. IBM Sterling B2B Services - Community Development Services - Document Verification Service consists of checking each Trading Partner s initial compliance with Client s EDI specifications by testing inbound Documents from Trading Partners against Client s EDI specifications. IBM's work includes sharing specifications with trading partners, setting up testing with trading partners, notification to Client as each trading partner passes testing, and developing biweekly summary reports. Client must provide the mapping specifications of the Documents to be tested and a trading partner list. The subscription fee for this service will be based on each Document type tested per Trading Partner. d. IBM Sterling B2B Services - Community Development Services - Partner Conversion Service consists of working with Client to convert existing VAN traffic and Client s Trading Partner community to the IBM B2B Collaboration Network. IBM's work includes contacting Trading Partners, notifying Trading Partners' VANs of the change, assigning a sponsor company ID to the Trading Partner's IBM Collaboration Network Mailbox, confirming that other VANs have routed IDs properly, monitoring Client s Mailboxes for five (5) business days, and working with Client to resolve Trading Partner/VAN issues. Client must provide a Trading Partner list. e. IBM Sterling B2B Services - Community Development Services - Partner Recruitment Service consists of recruiting Trading Partners to join Client s Trading Partner community. IBM will engage in up to three (3) communication efforts to reach Trading Partners to determine if they will comply with Client s community request and will provide weekly program status updates to Client. Client must provide a Trading Partner list. f. IBM Sterling B2B Services - Community Development Services Partner Test Coordination Service consists of coordination of the end-to-end testing process between Trading Partner and Client. IBM's work includes sharing specifications with Trading Partners, scheduling initial end-toend testing, monitoring and communicating test results to respective parties to facilitate corrective actions as appropriate and coordinating a go live date after successful testing has been completed and signed off. Client must provide the mapping specifications of the Documents to be tested and a Trading Partner list. The subscription fee for this service will be based on each Document type tested per Trading Partner. 1.2.5 On-Demand Services a. IBM Sterling B2B Services Collaboration Network - Client Services Assisted Mailslot Status Check consists of IBM checking the status of an EDI interchange or File within a Mailslot and communicating if the data was or was not found and if found, if the interchange or File was picked up. These details are communicated via phone call or email. b. IBM Sterling B2B Services Collaboration Network - Client Services Assisted Restore consists of IBM restoring data to a Mailslot after archival. c. IBM Sterling B2B Services Collaboration Network - Mailbox Set-up consists of allocating and setting up the Mailbox through which Client will send and receive data. 2. Security Description This Cloud Service follows IBM s data security and privacy principles for the Cloud Service which are available at https://www.ibm.com/cloud/resourcecenter/content/80 and any additional terms provided in this section. Any change to IBM s data security policies will not degrade the security of the Cloud Service. This Cloud Service is US-EU Safe Harbor certified. The Cloud Service does not encrypt content during data transmission between the IBM network and the endpoint networks or machines depending on the i126-6371-03 (11/2015) Page 2 of 7
protocol used. The Cloud Service does not encrypt content when at rest awaiting data transmission. Client is responsible to encrypt content prior to adding to the Cloud Service. 3. Service Level Agreement IBM provides the following availability service level agreement ( SLA ) for the Cloud Service as specified in a PoE. The SLA is not a warranty. The SLA is available only to Client and applies only to use in production environments. 3.1 Availability Credits Client must log a Severity 1 support ticket with the IBM technical support help desk within 24 hours of first becoming aware of an event that has impacted the Cloud Service availability. Client must reasonably assist IBM with any problem diagnosis and resolution. A support ticket claim for failure to meet an SLA must be submitted within three business days after the end of the contracted month. Compensation for a valid SLA claim will be a credit against a future invoice for the Cloud Service based on the duration of time during which production system processing for the Cloud Service is not available ( Downtime ). Downtime is measured from the time Client reports the event until the time the Cloud Service is restored and does not include time related to a scheduled or announced maintenance outage; causes beyond IBM s control; problems with Client or third party content or technology, designs or instructions; unsupported system configurations and platforms or other Client errors; or Client-caused security incident or Client security testing. IBM will apply the highest applicable compensation based on the cumulative availability of the Cloud Service during each contracted month, as shown in the table below. The total compensation with respect to any contracted month cannot exceed 10 percent of one twelfth (1/12th) of the annual charge for the Cloud Service. For bundled Cloud Services (individual Cloud Service offerings packaged and sold together as a single offering for a single combined price), the compensation will be calculated based on the single combined monthly price for the bundled Cloud Service, and not the monthly subscription fee for each individual Cloud Service. Client may only submit claims relating to one individual Cloud Service in a bundle at a given time. 3.2 Service Levels Availability of the Cloud Service during a contracted month: Availability during a contracted month Compensation (% of monthly subscription fee* for contracted month that is the subject of a claim) <99.9% 2% <99.0% 5% <95.0% 10% * If the Cloud Service was acquired from an IBM Business Partner, the monthly subscription fee will be calculated on the then-current list price for the Cloud Service in effect for the contracted month which is the subject of a claim, discounted at a rate of 50%. Availability, expressed as a percentage, is calculated as: the total number of minutes in a contracted month minus the total number of minutes of Downtime in a contracted month divided by the total number of minutes in the contracted month. Example: 500 minutes total Downtime during contracted month: 4. Technical Support 43,200 total minutes in a 30 day contracted month 500 minutes Downtime = 42,700 minutes 43,200 total minutes = 5% Availability credit for 98.8% availability during the contracted month After IBM notifies Client that access to the Cloud Service is available, technical support for the Cloud Service is provided via telephone, email, online forums, and an online problem reporting system. Any enhancements, updates, and other materials provided by IBM as part of any such technical support are considered to be part of the Cloud Service. Technical support is included with the Cloud Service and is not available as a separate offering. i126-6371-03 (11/2015) Page 3 of 7
More information about hours of availability, email addresses, online problem reporting systems, and other technical support communication vehicles and processes are described in the IBM Software as a Service Support Handbook. The following severities are used to track support tickets for the Cloud Service: Severity Severity Definition Response Time Objectives 1 Critical business impact/service down: Business critical Within 1 hour functionality is inoperable or critical interface has failed. This usually applies to a production environment and indicates an inability to access services resulting in a critical impact on operations. This condition requires an immediate solution. 2 Significant business impact: A service business feature or function of the service is severely restricted in its use or Client is in jeopardy of missing business deadlines. Within 2 business hours 3 Minor business impact: Indicates the service or functionality is usable and it is not a critical impact on operations. Within 4 business hours 4 Minimal business impact: An inquiry or non-technical request Within 1 business day 5. Entitlement and Billing Information 5.1 Charge Metrics The Cloud Service is available under the charge metric specified in the Transaction Document. Response Time Coverage 24x7 M-F business hours M-F business hours M-F business hours a. Connection is a unit of measure by which the Cloud Service can be obtained. A Connection is a link or association of a database, application, server, or any other type of device to the Cloud Service. Sufficient entitlement must be obtained to cover the total number of Connections which have been or are made to the Cloud Service during the measurement period specified in a Proof of Entitlement (PoE) or Transaction Document. b. Document is a unit of measure by which the Cloud Service can be obtained. A Document is defined as a finite volume of data that is enveloped within a document header and trailer record that marks its beginning and end. Sufficient entitlements must be obtained to cover the total number of Documents processed by the Cloud Service during the measurement period specified in a Proof of Entitlement (PoE) or Transaction Document. c. Entity ID is a unit of measure by which the Cloud Service can be obtained. An Entity ID is a unique identifier, which may be referred to in the Cloud Service environment by different terms that may include but would not be limited to Client s ID, partner ID, supplier ID, vendor ID, or EDI ID within the Cloud Service. Sufficient entitlements must be obtained to cover the total number of Entity IDs contained in the Cloud Service during the measurement period specified in Client s Proof of Entitlement (PoE) or Transaction Document. For the Cloud Service, an Entity ID is a unique identifier for a trading entity, regardless of that trading entity's organizational structure. d. Kilo Character is a unit of measure by which the Cloud Service can be obtained. A Kilo Character is defined as 1000 bytes of data. Sufficient entitlements must be obtained to cover the total number of Kilo Characters processed by the Cloud Service during the measurement period specified in a Proof of Entitlement (PoE) or Transaction Document. e. Request is a unit of measure by which the Cloud Service can be obtained. A Request is defined as the act by the client that authorized IBM to perform the service. Depending upon the service, the Request can be in the form of a written notice or a support request which is made by phone call, email, or online case. Sufficient entitlements must be obtained to cover the total number of Requests submitted to the Cloud Service during the measurement period specified in a Proof of Entitlement (PoE) or Transaction Document. 5.2 Set-Up Charges Set-up charges will be specified in the Transaction Document. 5.3 Partial Month Charges A partial month charge as specified in the Transaction Document may be assessed on a pro-rated basis. i126-6371-03 (11/2015) Page 4 of 7
5.4 Overage Charges If actual usage of the Cloud Service during the measurement period exceeds the entitlement specified in the PoE, Client will be charged for the overage as specified in the Transaction Document. 5.5 On Demand Charges On-Demand charges, as specified in the Transaction Document, will apply when Client requests activation of the On-Demand part. 6. Term and Renewal Options The term of the Cloud Service begins on the date IBM notifies Client of its access to the Cloud Service, as documented in the PoE. The PoE will specify whether the Cloud Service renews automatically, proceeds on a continuous use basis, or terminates at the end of the term. For automatic renewal, unless Client provides written notice not to renew at least 30 days prior to the term expiration date, the Cloud Service will automatically renew for the term specified in the PoE. For continuous use, the Cloud Service will continue to be available on a month to month basis until Client provides 30 days written notice of termination. The Cloud Service will remain available to the end of the calendar month after such 30 day period. 7. Additional Information 7.1 Content Processing IBM may, as part of the normal operation and support of the Cloud Service, collect personal information from Client (Client s employees and contractors) related to the use of the Cloud Service, through tracking and other technologies. IBM does so to gather usage statistics and information about effectiveness of our Cloud Service for the purpose of improving user experience or tailoring interactions with Client. Client confirms that Client will obtain or have obtained consent to allow IBM to process the collected personal information for the above purpose within IBM, other IBM companies and their subcontractors, wherever we and our subcontractors do business, in compliance with applicable law. IBM will comply with requests from Client s employees and contractors to access, update, correct or delete their collected personal information. For transactions performed in all EU Member States, Iceland, Liechtenstein, Norway and Switzerland, the following terms apply: Client agrees that IBM may process content including any personal data (as that term is defined in the EU Directive 95/46/EC) across a country border to the following countries: Australia, Canada, France, Germany, India, Ireland, Netherlands, the United Kingdom and the United States. Client agrees that IBM may, on notice, vary this list of country locations when it reasonably determines it necessary for the provision and support of the Cloud Service. With respect to the transfer of European Economic Area of Swiss personal data, the parties or their relevant affiliates may enter into separate standard unmodified EU Model Clause agreements in their corresponding roles pursuant to EC Decision 2010/87/EU with optional clauses removed. All disputes or liability arising under these agreements, even if entered into by affiliates, will be treated by the parties as if the dispute or liability arose between them under the terms of this Agreement. 7.2 Third Party Networks Transmission of content to and from the Cloud Service by Client and Client s Trading Partners may use third party networks. It is up to Client to choose the protocols and means used to transmit content on the Cloud Service and through third party networks. Client is advised to use the appropriate technology, such as adequate encryption if Client wants to protect Client s content, including Client IDs and passwords. 7.3 Links to Third Party Websites or Other Services If Client or a Cloud Service user transmits content to a third party website or other service that is linked to or made accessible by the Cloud Service, Client and the Cloud Service user provide IBM with the consent to enable any such transmission of content, but such interaction is solely between Client and the third party website or service. IBM makes no warranties or representations about such third party sites or services, and shall have no liability for such third party sites or services. 7.4 Unique Extensions If the Cloud Service contains user exits that allow Client (or Client s designated third party) to configure an IBM software application and Client (or Client s designated third party) utilize the user exits, then IBM i126-6371-03 (11/2015) Page 5 of 7
is not liable for any resulting configurations ( Unique Extensions ) and the Unique Extensions are not part of the Cloud Service. 7.5 Compiled Data IBM (i) may compile and analyze anonymous, aggregate, summary data related to Client s use of Cloud Service, and (ii) may prepare reports, studies, analyses, and other work product resulting from this compilation and analysis (collectively the Compiled Data ). IBM retains all ownership rights in and to the Compiled Data. IBM may copy Client s data to a non-production server within the Cloud Service environment for the exclusive purpose of testing and improving the quality of IBM s products. 7.6 Guest User Access Client and any third party user of the Cloud Service authorized by Client to access the Cloud Service to exchange data with Client or to use the Cloud Service on Client s behalf ( Guest User ) may be required to execute an online agreement provided by IBM in order to access and use the Cloud Service. Client is responsible for these Guest Users, including but not limited to a) any claims made by the Guest Users relating to the Cloud Service, b) charges incurred by the Guest User, or c) any misuses of the Cloud Service by these Guest Users. 7.7 Data Exchange The Cloud Service may include (1) the sending or receiving of data between Client and Client s Trading Partners; 2) transmission of data to and from Client s Trading Partners either via direct connections with IBM or interconnections through one or more gateways or networks provided by third parties ( Interconnect Services and each third party an Interconnect Provider ); or (3) certain translation services or other associated services. IBM may transfer or store the data outside of the country where Client or Client s Trading Partners are located solely for the purposes of providing the Cloud Service or as required by applicable law or legal process. EXCEPT AS SET FORTH IN A SEPARATE AGREEMENT BETWEEN CLIENT AND AN INTERCONNECT PROVIDER, IN NO EVENT WILL ANY INTERCONNECT PROVIDER HAVE ANY LIABILITY TO CLIENT IN CONNECTION WITH THE PROVISION OF THE CLOUD SERVICE. 7.8 Data Retention Unless otherwise stated in the description of the available Cloud Services, IBM will retain and provide online visibility to data for at least 35 and up to 42 days, via browser-based visibility tools. Once the data is no longer available the data is purged and is not recoverable. 7.9 Exclusions Instances of customized scripts that perform custom processing of the data prior to translation (inbound or outbound) are not documented or included as part of the Cloud Service. The Cloud Service may involve the transmission of content including Client ID and password from, to, or over third-party systems or networks, such as the Internet and other Interconnect Services, over which IBM exercises no control and for which IBM is not responsible or liable. IBM does not represent or warrant that content coming into the Cloud Service environment has been treated by the sender of the content as confidential, or that content transmitted from the Cloud Service environment will be treated by the recipient as confidential. Accordingly, Client should encrypt the content if Client wants to make the content unreadable or indecipherable in the Cloud Service environment and in transit over IBM and other third party networks, including any Interconnect Services. Client is responsible for, and assumes any risk for, choosing the protocols and means it uses to transmit content over IBM and other third party networks. 7.10 Communications Software and Equipment IBM must approve any communications software used to transmit data to (and receive data from) IBM. If the Cloud Service requires a connection of Client s equipment with IBM equipment (using common carrier communication devices or terminal equipment), the devices and equipment that Client provides (and use) must be of a type approved by IBM. IBM has the sole and exclusive right to select its own equipment, software, and communications carriers to provide the Cloud Service. Unless otherwise specified herein, Client is responsible for obtaining an appropriate internet service account and connection for accessing the Cloud Service. i126-6371-03 (11/2015) Page 6 of 7
7.11 Responsibilities 7.11.1 Client s Responsibilities Client will (and will, if applicable, require Client s Trading Partners to): a. ensure adequate security over Client s respective applications, hardware (including installing and maintaining appropriate firewalls to prevent unauthorized access), Mailboxes, and transmission and monitor those Mailboxes and transmissions; b. notify IBM of any translation errors or failures, processing errors or failures, nonconforming transmissions, failures to send or receive transmissions, or inability to access any Mailbox; c. inspect data for accuracy and completeness and encrypt the data if Client is required to make it (or wants to make it) unreadable or indecipherable in the Cloud Service environment and in transit over IBM and other third party networks, including any Interconnect Services; d. set the applicable data-processing parameters and transmissions parameters; e. ensure that appropriate safeguards are in place to identify data, processing, and transmission errors; f. maintain supporting data, files, and other materials sufficient to enable IBM to recover all data, files, and other materials (such as card files, tape files, disk files, and printer outputs) needed to reperform any service provided by Cloud Service; g. implement connectivity between Client and IBM and work with IBM during joint connectivity testing between Client and IBM; h. for any Cloud Service component where Client is required to provide a Trading Partner list, provide the following information: (1) Partner Name and Address; (2) Contact Name and Phone Number; (3) Fax Number (if available); (4) E-mail Address; (5) Value Added Service Provider (if applicable); (6) Qualifier and ID (if applicable); i. maintain business continuity and communicate expectations to the Trading Partner community, as it relates to test periods, migrations, and conversions of and to the Cloud Service; j. provide systems, security and communication architecture diagrams as reasonably requested; k. ensure that Client staff is available to provide assistance as IBM reasonably requires; and l. ensure each Cloud Service User protects their Account identification and password and controls who may access a Cloud Service User Account or use any Cloud Service on Client s behalf. 7.11.2 IBM Responsibilities IBM will not be responsible for: a. Client or any third party s equipment or software errors or failures; b. any failure by Client or a third party to act on any communication transmitted to (or by) Client; c. the creditworthiness or performance of any of Client s Trading Partners; d. data improperly transmitted by Client or Client s Trading Partners; e. Client Interconnect Services (or any errors in or failures of the Interconnect Services) to the extent caused by Client s Interconnect Services provider, Client, or Client s Trading Partners, or any force majeure events; or f. providing any reverse migration services if IBM has terminated any portion of the Agreement. 7.12 Defined Terms a. File one or more data, information, or program records bundled together with a specific name. b. Mailbox A private, secure electronic storage space that is assigned to Client and allows Client to send, store, and receive electronic data. c. Mailslot A component of a Mailbox that allows the drop off and pick up of data. i126-6371-03 (11/2015) Page 7 of 7