Swift Cloud ERP – NRS E-Invoicing Service Level Agreement

1. Introduction

1.1 This Service Level Agreement (SLA) sets out the service commitments and respective responsibilities of Sysmax Technologies Limited (“Sysmax”, “we”, “us” or “Service Provider”) and the taxpayer or business customer (“Customer”, “Taxpayer” or “you”) using Swift Cloud ERP for electronic invoicing connected to the Nigeria Revenue Service (NRS) Merchant Buyer Solution (MBS).

1.2 This SLA is intended for Sysmax’s System Integrator (SI) services. It describes the availability, support, incident response, service restoration, security, monitoring and communication commitments applicable to the Swift Cloud ERP components operated or managed by Sysmax.

1.3 This SLA supplements the customer’s Swift Cloud ERP subscription/order form, applicable service terms, data processing terms and privacy notice. If there is a conflict concerning NRS e-invoicing service levels, this SLA applies to that subject unless a signed customer-specific agreement expressly states otherwise.

1.4 Sysmax will perform its services in accordance with the applicable NRS MBS technical and operational requirements, including relevant invoice data, validation, secure transmission, digital-signature/cryptographic and interoperability requirements applicable to the approved integration route.

2. Parties and Service Description

2.1 Service Provider: Sysmax Technologies Limited, Nigeria. Product: Swift Cloud ERP. Service contact: support@sysmaxng.com. General contact: support@sysmaxng.com.

2.2 Customer: the taxpayer/business entity identified in the Swift Cloud ERP subscription, onboarding record or signed order form. Customer legal name, TIN, address and authorised contact details should be recorded in the customer’s onboarding record.

2.3 System Integration services covered by this SLA include: (a) configuring the Customer’s Swift Cloud ERP e-invoicing profile; (b) mapping relevant ERP invoice, supplier, buyer, product/service and tax data to the applicable NRS invoice schema; (c) preparing and validating invoice data before submission; (d) initiating invoice transmission through the NRS-approved integration route; (e) receiving and recording available validation/status responses and regulatory identifiers; (f) maintaining invoice processing logs and status visibility; (g) supporting exception investigation and correction; and (h) providing technical support for the integration.

2.4 This SLA covers only services and infrastructure operated or controlled by Sysmax. Unless Sysmax has separately been appointed and approved to act as an Access Point Provider (APP), Sysmax does not represent that it provides APP services or controls the availability of the NRS platform, an independent APP, public telecommunications networks, Customer devices or Customer internet connectivity.

2.5 NRS remains the authoritative platform for regulatory validation, acceptance/rejection, IRN and other official regulatory outcomes. A successful connection or HTTP response alone does not mean an invoice has been accepted by NRS.

3. Service Availability

3.1 Target availability: Sysmax targets 99.9% monthly availability for the production Swift Cloud ERP e-invoicing application and integration components under Sysmax’s operational control.

3.2 Availability is measured monthly as: (total minutes in the calendar month minus qualifying unavailable minutes) divided by total minutes in the calendar month, multiplied by 100. Qualifying unavailable minutes are periods when the in-scope production service is unavailable to the Customer due to a failure within Sysmax-controlled systems and the Customer cannot reasonably perform the core e-invoicing functions.

3.3 The availability target does not count: (a) announced scheduled maintenance; (b) emergency maintenance reasonably required to protect the service; (c) outages or degradation of NRS/MBS, an independent APP, external APIs, internet or telecommunications providers, electricity providers or other third-party infrastructure outside Sysmax’s reasonable control; (d) Customer-side hardware, software, configuration, credentials or network failures; (e) force majeure events; or (f) suspension permitted under the customer agreement or this SLA. Sysmax will nevertheless monitor, communicate and assist with third-party incidents where reasonably possible.

3.4 Scheduled maintenance will, where practicable, be notified in advance through the platform or the Customer’s registered contact channel. Emergency maintenance may be performed without advance notice where necessary to address a security risk, protect data or restore service.

3.5 During an external NRS/APP outage or connectivity interruption, Sysmax will preserve the invoice transaction state where technically possible, communicate the known impact, and support controlled retry or status checking when the external service becomes available. Sysmax will not mark an invoice as NRS-accepted unless an authoritative acceptance response is received.

4. Support, Incident Priority, Response and Resolution

4.1 Support and incident reporting are available 24 hours a day, 7 days a week for NRS e-invoicing incidents through the designated Swift Cloud ERP support channel and support email. Customers should provide the taxpayer name/TIN, affected invoice reference or IRN, time of incident, error message, screenshots or correlation/reference ID, and a contact person. Customers must not send passwords, API secrets, private keys or other authentication secrets in a support ticket.

4.2 Response time means the period from receipt of a valid incident report by Sysmax’s designated support channel to acknowledgement by a support representative. Resolution time means the period to restore the affected service or provide a workable resolution or mitigation. Resolution targets are targets for Sysmax-controlled issues; an external NRS/APP/telecommunications dependency may prevent final resolution within the target, in which case Sysmax will provide a workaround where available, keep the incident open, communicate progress and escalate to the relevant provider.

4.3 The following targets align with the NRS-published SLA for service providers.

5. Incident Priority Matrix

6. Incident Handling and Escalation

6.1 Sysmax will register and classify reported incidents, assign a reference number, investigate the cause, provide status updates proportionate to severity, implement a workaround or fix, and record closure details.

6.2 For P1 incidents, Sysmax will initiate immediate technical escalation to the responsible operations/development personnel and provide updates at reasonable intervals, normally at least every 30 minutes while the incident remains critical.

6.3 For P2 incidents, Sysmax will escalate to the technical lead where the issue is not progressing within the applicable response/resolution target. P3 and P4 issues will be handled through the normal support queue and escalated where necessary.

6.4 If an incident depends on NRS, an APP, a hosting provider or a telecommunications provider, Sysmax will record the dependency, raise or follow up the external incident where it has the right to do so, and keep the Customer informed. The external provider’s own service levels remain applicable to that provider.

6.5 An incident may be closed after service restoration or an agreed workaround has been implemented and the Customer has been notified. The Customer may request reopening if the reported issue persists.

7. Security and Data Protection

7.1 Sysmax will maintain appropriate technical and organisational measures designed to protect Customer e-invoicing data against unauthorised access, disclosure, alteration, loss or destruction, having regard to the nature of the data and applicable law.

7.2 Measures include, as appropriate: encrypted transmission using HTTPS/TLS; access controls and role-based permissions; tenant/customer data segregation; secure handling and restricted access to API credentials, certificates and cryptographic keys; logging and monitoring of relevant administrative and integration events; vulnerability and patch management; and backup and recovery procedures.

7.3 Sysmax will use Customer data only to provide, secure, support and improve the contracted services, comply with legal obligations, and perform the Customer’s documented instructions. Sysmax will not sell Customer invoice data or disclose it to unrelated third parties for their independent marketing.

7.4 Where Sysmax processes personal data on behalf of the Customer, the parties will comply with applicable Nigerian data protection law, including the Nigeria Data Protection Act 2023 and applicable regulatory requirements. The Customer remains responsible for determining the lawful basis for the business transactions and personal data it enters into the ERP, and for ensuring that its users are authorised.

7.5 Sysmax will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s data, provide available information reasonably necessary for the Customer to assess the incident, and cooperate with the Customer’s lawful incident-response obligations. This does not replace any statutory notification obligation imposed directly on either party.

7.6 The Customer must protect its user credentials, maintain authorised user access, promptly notify Sysmax of suspected compromise, keep endpoint devices reasonably secure and avoid sharing authentication secrets through unsecured channels.

8. Monitoring and Compliance

8.1 Sysmax will monitor the production application and integration components under its control, including service availability, relevant processing failures, error rates and operational alerts, to support timely detection and investigation.

8.2 Sysmax will maintain relevant transaction and audit records, including invoice references/IRNs where available, submission attempts, timestamps, returned statuses and error information, subject to applicable retention and data protection requirements.

8.3 On reasonable request, Sysmax will provide the Customer with information about material service incidents affecting that Customer and the status of unresolved e-invoicing transactions. Periodic service summaries may be provided where included in the Customer’s service plan.

8.4 Sysmax will maintain the integration in line with the applicable NRS MBS specifications and will assess relevant NRS technical updates. Changes that require Customer action, configuration changes or planned service interruption will be communicated where reasonably practicable.

8.5 The Customer is responsible for the accuracy, completeness and lawful status of its source invoice, buyer, supplier, product/service, tax and transaction data; timely correction of validation errors attributable to its data; maintaining valid NRS taxpayer registration and identifiers; and complying with its tax and invoicing obligations.

9. Service Credits, Remedies and Limitations

9.1 Where a failure to meet the 99.9% availability target is attributable to Sysmax-controlled services, the Customer may request a service review and applicable service credit. Any credit will be assessed against the affected Customer’s recurring Swift Cloud ERP/e-invoicing service fee for the relevant billing period, taking account of the extent and duration of the qualifying outage.

9.2 For critical incident response or resolution delays attributable solely to Sysmax, Sysmax will investigate the cause and may apply a service credit or rebate. The NRS-published SLA refers to a refund equivalent to 0.01% of the monthly accrued settlement fee for delays in resolving critical issues. Where no settlement fee is charged under the Customer’s SI arrangement, the parties will agree an equivalent credit basis in the order form or a written service-credit schedule.

9.3 To request a service credit, the Customer must submit a written request within 30 days after the relevant incident or monthly service report, providing the incident reference and supporting details. Credits are applied to future service fees unless otherwise required by law or agreed in writing; they are not cash refunds of unrelated subscription or implementation charges.

9.4 No service credit applies to excluded downtime under clause 3.3, incidents caused by the Customer or its users, or delays caused by inaccurate/incomplete Customer data, expired Customer credentials, external NRS/APP systems or third-party networks outside Sysmax’s reasonable control.

9.5 Nothing in this SLA excludes liability that cannot lawfully be excluded, including liability for fraud, wilful misconduct or obligations imposed by applicable data protection law. Any other liability limitations are governed by the signed customer agreement and applicable law.

10. Confidentiality

10.1 Each party will protect the other party’s confidential information using reasonable care and will use it only for purposes connected with the services and this SLA.

10.2 Confidential information may be disclosed to employees, professional advisers, hosting or support subcontractors and regulators who need to know it for the services or as required by law, provided appropriate confidentiality and security obligations apply.

10.3 Confidentiality obligations do not apply to information that is public through no breach, already lawfully known, independently developed without use of confidential information, or lawfully received from a third party.

11. Customer Responsibilities and Dependencies

11.1 The Customer will: maintain an active Swift Cloud ERP subscription and authorised users; provide accurate taxpayer, supplier, buyer, item, tax and invoice data; complete NRS onboarding and maintain valid Business ID, Service ID, certificates and credentials as applicable; provide timely access and cooperation for incident diagnosis; maintain suitable internet connectivity and endpoint security; and review NRS validation outcomes and correct rejected invoices.

11.2 The Customer must not attempt to bypass NRS validation, manipulate invoice payloads or IRNs, submit false or misleading information, or use another taxpayer’s credentials.

11.3 Sysmax is not responsible for tax assessments, penalties or regulatory consequences arising from inaccurate source data, Customer non-compliance, late invoice creation, failure to correct rejected invoices, or actions taken by NRS or another independent service provider, except to the extent directly caused by Sysmax’s breach of this SLA or applicable law.

12. Changes to the Service or SLA

12.1 Sysmax may update this SLA to reflect changes in NRS requirements, applicable law, security practices or service operations. Material changes will be notified to the Customer through email or the platform before taking effect where reasonably practicable.

12.2 Where a change materially reduces a service commitment, Sysmax will provide reasonable advance notice and the Customer may raise concerns before the effective date. Continued use after the effective date constitutes acceptance to the extent permitted by law and the underlying customer agreement.

13. Term, Suspension and Termination

13.1 This SLA takes effect when the Customer accepts it electronically, signs it, or activates the relevant NRS e-invoicing service, and remains in effect while the relevant service is provided.

13.2 Either party may terminate the e-invoicing service/SLA by giving 30 days’ written notice, subject to any minimum subscription term or payment obligations in the customer agreement.

13.3 Sysmax may suspend access immediately where reasonably necessary to address a material security threat, unlawful use, compromise of credentials, serious breach of NRS requirements, non-payment after applicable notice, or a risk to other customers or the platform. Where practicable, Sysmax will notify the Customer and restore access when the cause has been remedied.

13.4 On termination, the Customer may request an export of its available invoice and transaction data during the applicable retention/export period, subject to payment of outstanding fees, technical feasibility, legal retention requirements and the data processing terms.

14. Force Majeure

14.1 Neither party is liable for delay or failure caused by events beyond its reasonable control, including natural disasters, widespread power or telecommunications failures, civil disturbance, government action, cyber incidents not caused by the affected party’s failure to maintain reasonable safeguards, or an outage of NRS/MBS or an independent APP. The affected party will notify the other where reasonably practicable and take reasonable steps to mitigate the impact.

15. Governing Law and Dispute Resolution

15.1 This SLA is governed by the laws of the Federal Republic of Nigeria.

15.2 The parties will first attempt to resolve disputes through good-faith discussions between their designated representatives. If unresolved within 30 days, either party may refer the dispute to the competent courts in Abuja, Nigeria, unless the parties have agreed in writing to another lawful dispute resolution procedure.

16. Contact and Escalation Details

16.1 Service desk and incident reporting: support@sysmaxng.com.

16.2 General and contractual enquiries: support@sysmaxng.com.

16.3 The Customer’s designated service administrator and any additional escalation telephone number or ticket portal will be recorded in the Customer onboarding record or order form.

17. Acceptance

17.1 By signing below, accepting electronically, or activating the NRS e-invoicing service after being presented with this SLA, the parties acknowledge that they have read and agree to the service commitments and responsibilities stated herein.

Appendix A – Customer Onboarding Details

Customer legal name:

Tax Identification Number (TIN):

Registered address:

Swift Cloud ERP tenant/company:

Authorised service administrator:

Email / telephone:

Service commencement date:

Applicable subscription / order form reference:

Appendix B – SLA Measurement Notes

• Availability is measured monthly for production service components operated by Sysmax. The calculation and exclusions are set out in clause 3.
• Response targets are acknowledgement targets; resolution targets are restoration/resolution objectives. External dependencies may affect final completion and are handled under clauses 4 and 6.
• Incident priority is assigned by Sysmax based on impact and urgency, with the Customer able to provide relevant impact information.
• Service credits require a documented request and are subject to clauses 9.1–9.4 and any customer-specific order form.