-------------------------------------------------- DRAFT FOR ATTORNEY REVIEW ONLY — NOT LEGAL OR FINANCIAL ADVICE IMPORTANT: TechSecure IT Solutions Pvt Ltd does NOT guarantee absolute system availability. Uptime is subject to exclusions including maintenance windows, Client-caused outages, and force majeure events. SLA remedies are strictly limited to service credits as described in Section 10 and do not constitute a guarantee of uninterrupted service. This document is a structured preparation draft only. DPDP Act 2023 India compliance for processing BlueStar Fintech Pvt Ltd's payment technology customer data, IT Act 2000 compliance for IT service providers in India, RBI IT Framework for Payment System Operators and applicable NPCI compliance obligations that may apply to BlueStar Fintech Pvt Ltd's IT infrastructure must be confirmed with a qualified Indian attorney. GST on managed IT service fees under the CGST Act 2017, income tax treatment of IT service retainer income, and limitation of liability enforceability under the Indian Contract Act 1872 must be confirmed with a qualified Indian attorney and tax advisor before this agreement is signed. -------------------------------------------------- IT SERVICE LEVEL AGREEMENT — DRAFT FOR ATTORNEY REVIEW Document Ref: SLA-2026-001 Date of Preparation: June 1 2026 PROVIDER: TechSecure IT Solutions Pvt Ltd Mumbai Maharashtra India Email: [provider email] CLIENT: BlueStar Fintech Pvt Ltd Mumbai Maharashtra India Email: [client email] 1. RECITALS 1.1 TechSecure IT Solutions Pvt Ltd is a managed IT services and cloud infrastructure company based in Mumbai Maharashtra India providing 24x7 infrastructure monitoring, cloud management, and IT support services to technology and financial technology businesses. 1.2 BlueStar Fintech Pvt Ltd is a payment technology startup with 150 employees based in Mumbai India seeking managed IT infrastructure, cloud management, helpdesk, security monitoring, and backup services to support its payment platform operations. 1.3 Both parties confirm their mutual intent to document this IT service level arrangement on the terms of this agreement. 2. DEFINITIONS 2.1 Provider: TechSecure IT Solutions Pvt Ltd. 2.2 Client: BlueStar Fintech Pvt Ltd. 2.3 Services: The managed IT services described in Section 4. 2.4 Uptime: The percentage of time in a calendar month that the agreed managed infrastructure and systems are available and functioning as specified, excluding Maintenance Windows and SLA Exclusions. 2.5 Downtime: Any period during which the agreed managed systems are unavailable or not functioning as specified, excluding Maintenance Windows and SLA Exclusions. 2.6 Incident: Any unplanned interruption or degradation of the managed IT Services. 2.7 Severity Level: The classification of each Incident as P1 Critical, P2 High, P3 Medium, or P4 Low based on business impact as described in Section 6. 2.8 Response Time: The time from an Incident being logged to TechSecure IT Solutions Pvt Ltd's first acknowledgment. 2.9 Resolution Time: The target time from an Incident being logged to its resolution. 2.10 Service Credit: A credit applied against a future invoice as the sole remedy for SLA breach as described in Section 10. 2.11 Maintenance Window: The scheduled planned maintenance period on Sunday between 2:00 AM and 6:00 AM IST. 2.12 RTO: Recovery Time Objective being the maximum target time to restore services after a major outage being 4 hours. 2.13 RPO: Recovery Point Objective being the maximum data loss window being 24 hours. 2.14 Change Request: A formal request from BlueStar Fintech Pvt Ltd for a change to the managed IT environment as described in Section 13. 2.15 Governing Law: Laws of Maharashtra India. 2.16 Effective Date: The date both parties sign this agreement. 3. SCOPE OF IT SERVICES 3.1 TechSecure IT Solutions Pvt Ltd will provide the following managed IT Services to BlueStar Fintech Pvt Ltd: 1. 24x7 managed IT infrastructure monitoring covering all agreed servers, network devices, and cloud resources in the AWS India region with automated alerting and proactive incident identification. 2. Cloud server management and administration for BlueStar Fintech Pvt Ltd's AWS India region cloud infrastructure covering provisioning, configuration, performance monitoring, and capacity management. 3. IT helpdesk support available Monday to Saturday from 8:00 AM to 8:00 PM IST via ticketing system, email, and telephone for BlueStar Fintech Pvt Ltd's users. 4. Network security monitoring including firewall management, intrusion detection, and security alert response. 5. Monthly security patch management covering operating system and software patches applied during the agreed Maintenance Window. 6. Daily automated data backup as described in Section 12. 3.2 The following are NOT included in this agreement: 1. End-user hardware procurement or repair. 2. Software licensing or application development. 3. Physical on-site IT support at BlueStar Fintech Pvt Ltd's offices unless separately agreed. 4. RBI regulatory audit support or compliance advisory services. 5. Any service not listed in Section 3.1. 4. SERVICE AVAILABILITY AND UPTIME 4.1 TechSecure IT Solutions Pvt Ltd commits to the following monthly uptime guarantee for the agreed managed infrastructure: Monthly Uptime Guarantee: 99.9% Maximum Permitted Downtime per Month: 43.8 minutes 4.2 Uptime is calculated as: (Total minutes in month — Downtime minutes) / Total minutes in month × 100 4.3 Uptime calculation excludes Maintenance Windows and all SLA Exclusions listed in Section 9. 4.4 Note: The technical achievability of 99.9 percent uptime on the agreed infrastructure must be confirmed with a qualified IT architect before signing. 5. INCIDENT SEVERITY CLASSIFICATION 5.1 All Incidents are classified by TechSecure IT Solutions Pvt Ltd on logging using the following framework: P1 CRITICAL: Complete loss of production systems, payment platform unavailable, or a security breach actively in progress affecting the Client's ability to operate. Response Time: 30 minutes Resolution Target: 4 hours P2 HIGH: Significant degradation of a core system affecting a large number of users or a critical business function with no workaround available. Response Time: 2 hours Resolution Target: 8 hours P3 MEDIUM: Partial service degradation affecting a limited number of users or a non-critical function. A workaround may be available. Response Time: 4 hours Resolution Target: 24 hours P4 LOW: Minor issue affecting a single user or cosmetic defect. No significant business impact. Response Time: Next business day Resolution Target: 72 hours 5.2 Resolution Time targets are best efforts. Some complex incidents may require longer resolution times. If a resolution target cannot be met TechSecure IT Solutions Pvt Ltd will provide a status update every 2 hours for P1 and every 4 hours for P2 incidents. 6. INCIDENT MANAGEMENT PROCESS 6.1 BlueStar Fintech Pvt Ltd must log all Incidents through the TechSecure IT Solutions Pvt Ltd ticketing portal or by calling the 24x7 operations centre for P1 and P2 incidents. 6.2 TechSecure IT Solutions Pvt Ltd will acknowledge each Incident within the Response Time for the applicable severity level. 6.3 Escalation path for unresolved Incidents: First line: Helpdesk Engineer Second line: Senior IT Engineer Third line: Operations Manager Executive: IT Director 6.4 BlueStar Fintech Pvt Ltd must provide timely and accurate technical information requested by TechSecure IT Solutions Pvt Ltd to assist Incident diagnosis and resolution. Delays caused by the Client's failure to provide requested information will suspend Resolution Time clocks. 7. MAINTENANCE WINDOWS 7.1 The agreed planned Maintenance Window is every Sunday between 2:00 AM and 6:00 AM IST. 7.2 TechSecure IT Solutions Pvt Ltd will provide BlueStar Fintech Pvt Ltd with at least 48 hours advance written notice of any planned maintenance activity scheduled within the Maintenance Window. 7.3 Downtime occurring within the agreed Maintenance Window is excluded from SLA Uptime calculation. 7.4 For emergency maintenance required outside the Maintenance Window to address a critical security vulnerability or imminent system failure, TechSecure IT Solutions Pvt Ltd will provide as much advance notice as practicable and will seek BlueStar Fintech Pvt Ltd's prior verbal or written approval before proceeding. 8. SLA EXCLUSIONS 8.1 The following circumstances are excluded from Downtime calculation and SLA measurement and TechSecure IT Solutions Pvt Ltd will not be liable for service credits arising from: 1. Force majeure events including natural disasters, government actions, power grid failures, and events beyond TechSecure IT Solutions Pvt Ltd's reasonable control. 2. Outages caused by BlueStar Fintech Pvt Ltd's own actions, changes, or omissions including unauthorized configuration changes, installation of unsupported software, or failure to apply recommended security patches. 3. Outages caused by third-party infrastructure or services outside TechSecure IT Solutions Pvt Ltd's control including AWS India region platform outages, internet service provider failures, or third-party application failures. 4. Downtime occurring within agreed Maintenance Windows. 5. Outages arising from Client-approved Change Requests. 6. Periods during which BlueStar Fintech Pvt Ltd has suspended TechSecure IT Solutions Pvt Ltd's access to systems required to deliver the Services. 8.2 Note: SLA exclusion provisions must comply with the Consumer Protection Act 2019 India and the Indian Contract Act 1872. A qualified attorney must confirm their enforceability. 9. SERVICE CREDITS 9.1 Service credits are the sole and exclusive remedy available to BlueStar Fintech Pvt Ltd for any SLA uptime breach in any calendar month. 9.2 The following service credit schedule applies based on actual monthly uptime: Uptime 99% to 99.9%: 10% of monthly service fee Uptime 95% to below 99%: 20% of monthly service fee Uptime below 95%: 30% of monthly service fee 9.3 The maximum total service credit payable in any single calendar month is 30% of that month's service fee being a maximum of INR 36,000. 9.4 Service credits are applied as a credit against BlueStar Fintech Pvt Ltd's next monthly invoice and are not paid as cash refunds under any circumstances. 9.5 BlueStar Fintech Pvt Ltd must submit a service credit claim in writing within 30 days of the end of the affected calendar month. Claims submitted after 30 days will not be accepted. 9.6 Note: Service credits as exclusive remedy provisions must comply with the Consumer Protection Act 2019 India and may not be enforceable in all circumstances. A qualified attorney must confirm. 10. DISASTER RECOVERY AND BUSINESS CONTINUITY 10.1 TechSecure IT Solutions Pvt Ltd commits to the following disaster recovery targets for BlueStar Fintech Pvt Ltd's managed AWS India infrastructure: RTO: 4 hours from declaration of a major outage. RPO: 24 hours maximum data loss. 10.2 TechSecure IT Solutions Pvt Ltd will maintain disaster recovery procedures covering failover to backup infrastructure within the AWS India region and will conduct a disaster recovery test at least once per year with results reported to BlueStar Fintech Pvt Ltd. 10.3 Note: RTO and RPO targets must be confirmed as technically achievable on BlueStar Fintech Pvt Ltd's specific AWS infrastructure before signing. RBI IT Framework requirements for payment technology companies regarding business continuity and disaster recovery must be confirmed with a qualified attorney. 11. DATA BACKUP AND RETENTION 11.1 TechSecure IT Solutions Pvt Ltd will perform automated daily backups of all agreed managed data within BlueStar Fintech Pvt Ltd's AWS India environment. 11.2 Backup data will be retained for 30 days and stored in an encrypted AWS S3 bucket in a geographically separate AWS India availability zone. 11.3 BlueStar Fintech Pvt Ltd may request data restoration from backup by raising a P2 priority support ticket. Restoration is subject to the RTO commitment of 4 hours and depends on data volume. 11.4 Note: DPDP Act 2023 India compliance for backup storage of customer financial data, RBI data localisation requirements for payment technology operators, and applicable data retention obligations must be confirmed with a qualified Indian attorney. 12. CHANGE MANAGEMENT 12.1 BlueStar Fintech Pvt Ltd must submit all requests for changes to the managed IT environment through the TechSecure IT Solutions Pvt Ltd change request portal with at least 5 business days notice for standard changes and 48 hours for urgent changes. 12.2 TechSecure IT Solutions Pvt Ltd will assess each Change Request and provide a written impact assessment including estimated downtime risk within 3 business days. 12.3 Changes approved by both parties through this process that cause temporary service disruption are excluded from SLA Downtime measurement. 12.4 Emergency changes required to address a critical security vulnerability will be implemented with verbal approval from BlueStar Fintech Pvt Ltd's nominated IT contact followed by written confirmation within 24 hours. 13. SECURITY COMPLIANCE 13.1 TechSecure IT Solutions Pvt Ltd will maintain its information security management practices in accordance with ISO 27001 standards and applicable CERT-In guidelines for IT service providers in India. 13.2 In the event of a confirmed data breach or security incident affecting BlueStar Fintech Pvt Ltd's data, TechSecure IT Solutions Pvt Ltd will notify BlueStar Fintech Pvt Ltd within 6 hours of confirmation of the breach. 13.3 Note: CERT-In Incident Reporting Rules 2022 six-hour mandatory breach reporting obligation for IT service providers, DPDP Act 2023 data breach notification requirements, and applicable RBI cybersecurity framework obligations for payment technology companies must be confirmed with a qualified Indian attorney. 14. CLIENT RESPONSIBILITIES 14.1 BlueStar Fintech Pvt Ltd agrees to: 1. Provide timely and accurate technical information to assist Incident diagnosis and resolution. 2. Maintain all Client-side endpoint devices, local network equipment, and internet connections in good working order. 3. Notify TechSecure IT Solutions Pvt Ltd at least 5 business days in advance of any planned changes to BlueStar Fintech Pvt Ltd's own infrastructure that may affect the managed Services. 4. Ensure only authorized BlueStar Fintech Pvt Ltd personnel submit support requests. 5. Not make unauthorized changes to any managed systems. 14.2 TechSecure IT Solutions Pvt Ltd is not liable for any SLA failure arising from BlueStar Fintech Pvt Ltd's failure to meet its responsibilities in this section. 15. DATA PROTECTION AND PRIVACY 15.1 TechSecure IT Solutions Pvt Ltd will process BlueStar Fintech Pvt Ltd's data only for the purposes of delivering the Services and in accordance with the Digital Personal Data Protection Act 2023 India and BlueStar Fintech Pvt Ltd's written instructions. 15.2 BlueStar Fintech Pvt Ltd is the data principal for its customer and employee data. TechSecure IT Solutions Pvt Ltd acts as a data fiduciary and processor only to the extent required to deliver the Services. 15.3 TechSecure IT Solutions Pvt Ltd will not share BlueStar Fintech Pvt Ltd's data with any third party except AWS India as the cloud infrastructure provider and as required by applicable Indian law. 15.4 Note: DPDP Act 2023 India data processing obligations for IT managed service providers, RBI data localisation requirements, and applicable NPCI data governance standards must be confirmed with a qualified attorney. 16. FEES AND PAYMENT 16.1 BlueStar Fintech Pvt Ltd will pay TechSecure IT Solutions Pvt Ltd a monthly service fee of INR 1,20,000 covering all Services in Section 3.1. 16.2 The fee is payable on the 1st of each month by NEFT to TechSecure IT Solutions Pvt Ltd's nominated bank account. 16.3 TechSecure IT Solutions Pvt Ltd will issue a GST-compliant tax invoice on the 1st of each month. 16.4 If payment is not received within 15 days of invoice date interest accrues at 18 percent per annum from the 15th day. 16.5 TechSecure IT Solutions Pvt Ltd may suspend non-critical Services if any invoice remains unpaid for 30 days. 16.6 Note: GST on managed IT services under the CGST Act 2017, income tax treatment of IT retainer income, and TDS deduction obligations on IT service fees must be confirmed with a qualified Indian tax advisor. 17. LIMITATION OF LIABILITY 17.1 TechSecure IT Solutions Pvt Ltd's total liability for any SLA uptime breach is strictly limited to the service credits described in Section 9. 17.2 TechSecure IT Solutions Pvt Ltd's total aggregate liability under this agreement for any claim is limited to the total fees paid by BlueStar Fintech Pvt Ltd in the 12 months immediately preceding the claim. 17.3 TechSecure IT Solutions Pvt Ltd is not liable for any indirect, consequential, data loss, revenue loss, or business interruption claims beyond the service credit mechanism. 17.4 Note: Limitation of liability clauses must comply with the Consumer Protection Act 2019 India and Indian Contract Act 1872. RBI regulated entities may have additional liability obligations that must be confirmed with a qualified attorney. 18. TERM AND RENEWAL 18.1 This SLA covers an initial term of 12 months from the Effective Date. 18.2 The agreement will renew automatically for successive 12-month periods unless either party gives 60 days written notice of non-renewal before the end of the current term. 19. TERMINATION 19.1 Either party may terminate for convenience with 60 days written notice. 19.2 TechSecure IT Solutions Pvt Ltd may terminate immediately for non-payment outstanding for more than 45 days. 19.3 Either party may terminate for material breach with 30 days written notice and a 30-day cure period. 19.4 On termination TechSecure IT Solutions Pvt Ltd will provide up to 30 days of transition assistance including data export support and system access handover to BlueStar Fintech Pvt Ltd or its nominated successor provider. 20. GOVERNING LAW AND DISPUTES 20.1 Laws of Maharashtra India and the IT Act 2000 govern this agreement. 20.2 Disputes proceed through direct negotiation then binding arbitration in Mumbai. SIGNATURE BLOCK: Note: Both parties must have this agreement reviewed by a qualified Indian attorney and tax advisor before signing. DPDP Act 2023 data processing obligations, CERT-In incident reporting compliance, RBI IT Framework and cybersecurity obligations for payment technology companies, IT Act 2000 compliance, GST on IT service fees, TDS obligations, service credit enforceability under Consumer Protection Act 2019, and limitation of liability under Indian Contract Act 1872 must all be confirmed before this agreement commences. TechSecure IT Solutions Pvt Ltd (Provider) Signature: ________________ Name: ____________________ Title: ___________________ Date: ____________________ BlueStar Fintech Pvt Ltd (Client) Signature: ________________ Name: ____________________ Title: ___________________ Date: ____________________ -------------------------------------------------- This IT Service Level Agreement draft was generated by an AI drafting tool as a structured preparation and documentation aid only. It does not constitute legal or financial advice. SLA remedies are limited to service credits only. Always have this document reviewed by a qualified attorney before either party signs. --------------------------------------------------