Every serious sales call eventually asks it: "what's your SLA?" And too many small teams answer with a number someone once said out loud — 99.99%, one-hour response, 24/7 support — that nobody wrote down and nobody can honor. The fix is not a longer contract. It is a definition you can fit on one page: three sentences that say what you measure, what you target, and what you promise. Here is the whole thing.
The three words, one sentence each
- SLI — the measurement. The thing you actually count: successful responses over total, share of requests under 500ms, minutes from page to first human acknowledgment. If a human has to assemble the number by hand every month, it is not an SLI — it is a story.
- SLO — the target. The line the team holds itself to on that measurement: 99.5% availability over a rolling 30 days, p95 under 800ms, first human response in 15 minutes for S1. Internal. The team lives inside it; nobody outside needs to see it.
- SLA — the promise. The external document with named consequences. The test that keeps all three honest: every SLA line traces to an SLO, every SLO to an SLI you can produce on demand. A promise with no measurement behind it is a future apology with a signature.
Pick SLIs you can actually measure
- Availability from real traffic — one number from the health check or load balancer. Crude and true beats elaborate and imagined.
- Latency as p95, not average. The average hides the tail, and the tail is what customers experience. Promise on the percentile you can measure.
- Time to first human response — the SLI small teams forget and customers remember. The cheapest one to improve, and the one that makes every other number forgivable.
- The production test: who produces this number, how often, where does it live? "Whoever is awake, monthly, in a spreadsheet" means automate it or pick a cruder number you can automate.
The 2× headroom rule
Look at what you delivered last quarter and promise roughly half the failure rate. Measured 99.7%? Promise 99.5%, not 99.9%. The headroom is not sandbagging — it is where deploys, rollbacks, and Tuesday mistakes live without breaking faith. Every SLO needs two details or it is a vibe: the measurement window (rolling 30 days is the honest default — a calendar-month SLO lets a bad week hide in a good one) and where the number is published.
The external SLA, in plain words
- Name the covered thing precisely: "The Dashboard web application and its API at app.example.com." Not "the service." The customer should be able to point at a URL.
- State the hours: 24/7 paging for S1 with a named on-call human, best-effort business hours for the rest, is a legitimate — and sustainable — small-team SLA. Nobody sane wants a 3AM call about a billing export.
- Exclusions in the same voice as the promises: maintenance announced 48h ahead, third-party outages you do not control, the customer's own configuration and keys. Exclusions are not fine print — the customer who reads only the exclusions is the one who stays a customer.
- The plain-words test: hand the draft to someone non-technical. If they cannot say back what they are entitled to, the SLA was written to win arguments, not to keep customers. Rewrite it.
Response times tied to severity — the ladder you already run incidents with
S1 (production down): acknowledge in 15 minutes, work continuously, hourly updates. S2 (degraded, workaround exists): 2 business hours. S3: next business day. Using the same severity matrix for customer tickets and your own incidents means the ticket and the pager speak one language. And promise acknowledgment, not instant repair — resolution depends on the bug; a human who answers, says what they are doing, and says when they will speak again is what "responsive" means at 2AM.
Consequences: credits are theater, honesty is not
A 10% credit on a $19/month plan is $1.90 — nobody churns over it. What saves the relationship: the outage was announced before the customer noticed, updates were rhythmic, and a written postmortem arrived after. When procurement genuinely needs a credit clause: cap it at the last month's fees, 30-day claim window, S1 breaches only, measured on the same dashboard the team watches.
The quarterly review that retires promises
Once a quarter, one hour: measured numbers next to promised numbers, from dashboards — not from memory. Missed once with a story: note it. Missed twice: the SLO is wrong — fix the system or lower the number. A promise you miss repeatedly is not a stretch goal; it is a lie on a schedule, and customers keep receipts. Let every S1 postmortem and every third-party outage edit the document. And when a number must come down, tell customers before the next billing cycle — renegotiating before the breach is integrity; renegotiating after the invoice is churn with extra steps.
Small-team honesty note: if the team is one founder and a part-time admin, your SLA is one page with five lines and a phone you actually answer — and that beats most enterprise SLAs, which promise a human and deliver a queue. Promise less than you deliver. Measure what you promise. Never sign a number you have not seen yourself produce twice.
Related reading: the uptime and downtime budget · the severity matrix · the status page communication template · the on-call compensation policy
If you want the incident-response starter kit: the Ops Starter Kit ($14) bundles the checklists behind these playbooks, and The First 30 Minutes is free.
Top comments (0)