1. Purpose and parties
This Service Level Agreement (SLA) sets out the service levels under which Laflor Logic Limited (“the Provider”), operating the Jabuntu e-invoicing platform as a National Revenue Service (NRS) System Integrator, delivers e-invoicing services to taxpayer organisations (“the Customer”). It covers availability, performance, support, security and data handling for invoice preparation, validation, and the issuance of the Invoice Reference Number (IRN) and QR code through the NRS Merchant Buyer System (MBS). It does not cover the availability of the NRS MBS itself or third-party networks outside the Provider’s control.
2. Service availability
| Service tier | Monthly availability target | Maximum scheduled maintenance |
|---|---|---|
| Production e-invoicing | 99.5% | 4 hours/month, off-peak, with at least 48 hours’ notice |
| Sandbox / testing | 99.0% | As required, with notice |
Availability excludes scheduled maintenance (notified at least 48 hours in advance, outside Nigerian business hours) and excluded events.
3. Performance (95th percentile)
| Operation | Target |
|---|---|
| Local validation and MBS payload preparation | ≤ 2 seconds |
| Submission for NRS validation (excluding NRS processing time) | ≤ 3 seconds |
| Status / QR retrieval | ≤ 2 seconds |
4. Support and incident response
Support is available during Nigerian business hours (Monday–Friday, 08:00–18:00 WAT), with an emergency channel for severity-1 incidents outside those hours.
| Severity | Response time | Target resolution |
|---|---|---|
| S1 — Critical (service unavailable) | 30 minutes | 4 hours |
| S2 — Major (significant degradation) | 2 business hours | 1 business day |
| S3 — Minor (limited impact) | 1 business day | 5 business days |
| S4 — Query / request | 2 business days | As scheduled |
Response time is the time to acknowledge and begin work; resolution time is a target, not a guarantee, and may depend on NRS.
5. Data protection and security
- Data in transit is protected with TLS 1.2/1.3; data at rest with AES-256.
- Taxpayer signing keys are held in a managed key store (AWS KMS / HSM-backed) and never exposed to the browser.
- Access requires authentication with multi-factor (authenticator-app) one-time codes; roles are least-privilege.
- All validation and signing outcomes are recorded in an append-only, tamper-evident audit trail.
- The Provider maintains ISO 27001 certification and handles personal data in line with the Nigeria Data Protection Act (NDPA).
- Data residency follows NRS requirements.
6. Backup, continuity and retention
- Managed database backups are taken daily with point-in-time recovery.
- Invoice records and audit evidence are retained for the period required by Nigerian tax law.
- On termination, the Customer’s data is exported to them and then securely deleted within an agreed window.
7. Reporting, review and exclusions
Availability and incident reports are provided monthly on request; this SLA is reviewed at least annually. Exclusions: NRS MBS outages or changes, third-party network or cloud-provider outages, notified maintenance, and issues caused by the Customer’s own systems, data errors or misuse.