Web agency SLA 2026: what it must contain (and how to negotiate)

SLA: the contract that separates a serious agency from a vanishing freelancer

SLA = Service Level Agreement. It's the agency's contractual commitment to the quality of the service rendered: site availability, response time on incident, resolution time, penalties if the commitment is not met. Without a written SLA, you have no recourse when the site is down for 3 days.

In 2026, 70 % of agency-client contracts in Senegal and 50 % in France contain no explicit SLA. From the agency side, it's comfortable: everything is "best effort". From the client side, it's total exposure: no commitment of means, even less of results. This article details the 8 elements an SLA must contain, and the 10 negotiable points before signing.

The 8 mandatory elements of an SLA

1. Service scope

Which services are covered by the SLA:

• Main site only, or including subdomains?
• Is hosting included or externalized?
• Which features are critical (front, back-office, payment, API)?

2. Guaranteed uptime

Availability commitment, expressed as annual percentage:

Market reality: 99.9 % is the 2026 standard for a pro site, 99.5 % enough for a showcase. 99.99 % is rare and expensive (requires multi-region redundancy).

3. Response time

Delay between incident declaration by the client and the first acknowledgement by the agency. 2026 standard:

• Critical incident (full site down): < 1 h (24/7) to < 4 h (business hours)
• Major incident (main feature down): < 4 h to < 8 h
• Minor incident (cosmetic bug): < 24 h to < 48 h
• Support question: < 48 business hours

4. Resolution time

Delay between declaration and complete resolution. Much harder to guarantee than response time, so often expressed as "best effort" with an average commitment:

• Critical: 4-8 h for resolution on 95 % of incidents
• Major: 24 h on 90 % of incidents
• Minor: 7 days

5. Scheduled maintenance windows

When the agency can cut service for an update without it counting as downtime:

• Night (2am-6am local time) or weekend
• Client notice: 48-72 h
• Max duration: 2-4 h / month

6. Penalties for non-compliance

Without penalties, the SLA is just a statement of intent. 2026 standard:

7. Exclusions

What doesn't count as a breach:

• Force majeure (natural disaster, global Cloudflare outage, AWS down)
• DDoS attack beyond a certain volume (> 10 Gbps for example)
• Client action (mishandling, file deletion)
• Announced scheduled maintenance
• Third-party service unavailability (Stripe, Wave, OAuth)

8. Measurement method

How is uptime measured?

• Via a third-party tool (UptimeRobot, Pingdom, Better Stack) consultable by both parties
• Check frequency: 1 min, 5 min, 15 min
• Probe location (Europe + Africa ideally)

Example complete SLA for a standard e-commerce

`

SLA Kolonell — Standard Maintenance Plan

• Scope: main site + shop subdomain, hosting included
• Guaranteed uptime: 99.9 % measured via UptimeRobot (1 Paris probe + 1 Dakar probe, 1 min check)
• Response time:
• Critical: < 1 h (business 8am-8pm), < 4 h (night/WE)
• Major: < 4 h business days
• Minor: < 24 h business days
• Resolution time:
• Critical: 4 h for 90 % of incidents, 12 h for 100 %
• Major: 24 h for 95 % of incidents
• Minor: 7 days
• Scheduled maintenance: 1 window / month max, Sunday 2am-6am, 72 h notice
• Penalties:
• Uptime < 99.9 %: 15 % credit of monthly fee (250,000 FCFA → 37,500 FCFA credit)
• Uptime < 99.0 %: 50 % credit
• Uptime < 95.0 %: 100 % credit + immediate termination right
• Exclusions: force majeure, > 5 Gbps DDoS attacks, client action, scheduled maintenance
• Measurement: UptimeRobot, monthly report sent on the 5th of the following month

`

10 negotiable points before signing

• Uptime target: push to 99.9 % minimum, 99.5 % for non-critical showcases
• Response time business hours vs 24/7: 24/7 costs 2-3× more but necessary for e-commerce
• More aggressive penalties: raise to 25-50 % of monthly fee rather than the standard 10-15 %
• Third-party measurement tool: require read access to UptimeRobot or Pingdom (no "trust me")
• Expanded scope: include transactional emails, critical third-party APIs
• Reduced exclusions: avoid overly broad clauses like "any third-party issue"
• Maintenance notice: push from 24 h to minimum 72 h, refuse windows < 2 h without notice
• Out-of-SLA modification hours: how many support hours included monthly?
• Exit clause: ability to terminate within 30 d if SLA missed 2 consecutive months
• Full site export: guarantee to recover everything (code, DB, media) in a defined timeframe in case of break-up

SLA structure recap table

FAQ

What if the agency refuses any SLA?

Major red flag. Either they don't master their service, or they want total control. Don't sign.

Does the SLA always include hosting?

Not always. If hosting is directly at OVH or DigitalOcean, the agency SLA depends on the host SLA (99.9 % OVH, 99.99 % AWS). Ask for the breakdown.

How to verify an SLA is respected?

1) Third-party uptime monitoring tool (UptimeRobot free up to 50 monitors), 2) detailed monthly report, 3) read access to server logs.

How much does a 99.99 % SLA cost?

Multiply the standard plan by 3 to 5 (need multi-region redundancy, 24/7 monitoring, on-call team). Reserved for sites where each hour of downtime costs more than 500,000 FCFA in lost revenue.

Is an SLA needed for a non-critical showcase?

Yes, even a light one: 99.5 % uptime + < 24 h response + best effort resolution. At least you know what you're committing to.

Let's talk about your SLA

If you want to review your current SLA or negotiate a new one with your agency, contact us for an independent opinion. WhatsApp +221 77 596 93 33.