1.    Introduction

Lucidity Software applications provided to clients as Software as a Service (SaaS) are hosted via leading cloud hosting providers.  Our strategy is to utilise the best available virtual server and cloud storage providers, reflecting the market offerings and taking into account:

• Service Level Agreement (SLA)
• Bandwidth
• Latency
• Backup services
• Our experience with the provider.

2.    Providers

Our providers are:

• Amazon AWS - http://www.amazon.com/aws/ 

Lucidity Software has services located in the Sydney AWS data centre with a multi availability zone configuration.

3.    Service Provision

Guaranteed uptime from our providers is 99.9%.  This uptime has been met for the duration of our time with our current providers (>3 years for each provider).  Uptime calculations do not take into account scheduled maintenance. 

4.    On-Site (Provider) Backups

A nightly on-site server image is taken by Amazon AWS (database and application servers). These are accessible by Lucidity Software.  Depending upon when the data in question was created and deleted or modified, it may be available on one of the backups. If so it is retrievable by Lucidity Software and maybe re-instated. 

Database backups are taken nightly, stored in AWS Sydney data centre and are retained for a 1 year period. 

5.    Offsite Backups

A nightly database export is conducted from Amazon AWS to Amazon S3. This export is conducted on a per application / client basis, and is controlled and operated by Lucidity.  A summary is provided to each morning to confirm that the daily backup was successful. The backup can be accessed by Lucidity to recover lost data or to restore services at an alternative location in the event that a catastrophic disruption is experienced at either provider. 

6.    Disaster Recovery

Lucidity has multiple levels of Disaster Recovery, which are invoked based on the severity of the incident, and the degree to which our Service Providers are affected.  Incidents are classified in the following manner:

• Major – more severe than Minor, where there is an expectation of extended service unavailability exceeding 24 hours
• Catastrophic – impact is more severe than Major, and there is an expectation that the service cannot be restored unless significant intervention occurs

Major:

Major incidents see the main service providers available globally, but affected temporarily at a regional level. In this instance we will fail over to the nearest geographical region within Australia, within the Amazon AWS network utilising the most recent instance level snapshots. 

Catastrophic:

Catastrophic incidents are where primary service providers, such as Amazon AWS become unavailable, or appropriate geographical regions become unavailable (in the event of extreme natural disasters, etc.).

Lucidity has cloud infrastructure available external to AWS that can be used as an alternate server should Amazon AWS be offline due to an extended interruption. It would use the most recent offsite database backup, and would be brought online in the event that there is an extended outage or catastrophic failure at the primary data centre.  

As this server is already operating and has the current software configuration, the process for making it a temporary production server only requires migration of the appropriate database(s).

Once the initial Disaster has been recovered from, Lucidity will migrate to a Cloud Provider within the Australian region.

Data Loss due to Incidents

In both Major and Catastrophic incidents, the maximum data loss is 24 hours of information.

Additional Background: Using Amazon AWS for Disaster Recovery 

7.    Data Security, Confidentiality and Privacy

Client data is managed in accordance with the Lucidity accredited ISO 27001 Information Security Management System (ISMS).  

All data is the property of the client, and will not be used for any purpose or passed on to any third party by Lucidity Software, other than where require to provide the SaaS hosting service.   Lucidity does not disclose any information collected by Lucidity from clients or stored by clients in their instance of Lucidity, for any purposes other than providing the software service.  The Lucidity ISMS details controls to ensure that all Lucidity personnel and any subcontractors who may require access to client data are employed or engaged and their access managed in accordance with industry best practice.

The Lucidity ISMS applies the 'need to know and need to use' principle when determining if access to client data is required by individual team members, monitors and logs all access, and has robust processes for promptly rescinding access when no longer required or appropriate.

The Lucidity ISMS includes processes to ensure compliance with the Notifiable Data Breach (NDB) scheme, which was established under the Privacy Amendment (Notifiable Data Breaches) Act 2017.  Lucidity has carried out an assessment of the data that is captured within Lucidity, and has published the following document which details the results of the assessment.  

NDB Scheme: Assessment of Personal Data within Lucidity

8.    Service requests, Fault reporting, Classification and Rectification

Service requests, software faults and other requests should be reported to our help centre by emailing support@luciditysoftware.com.au or by logging in to the Lucidity Support Portal.  Clients have up to three nominated Administrators who can access the Lucidity helpdesk for this purpose. 

The classification of requests, faults and the associated response and resolution targets are detailed on our Service Level Agreements (SLAs) page. 

Your Lucidity contract comes with the level of support detailed in your Onboarding & Assist packages. If you need to change your package to better suit your business needs, please reach out to your Sales team member or support@luciditysoftware.com.au to discuss your options.

When making a request or reporting a fault, it is important to include as much information as possible.  Our ability to diagnose and respond appropriately will be effected by the amount of information provided when the request is made.  After a request is, a Priority will be allocated and the progress tracked through the Lucidity Support Portal.

The Resolution Target is our target response time to resolve a request or fault.  Our ability to meet the Resolution Target is effected by a number of factors, including whether a software deploy to your instance of Lucidity Software is required and whether software programming is required (and the associated testing and release process).  If the resolution requires a change to the Lucidity App, then the applicable design and testing process is undertaken, as well as associated steps to release the new version of the Lucidity App through the applicable Apple and Google stores.  These steps have associated timeframes which are set by the respective providers.  Due to these and similar considerations, while the Resolution Target is our objective it may not always be possible to satisfy the applicable timeframe depending on the circumstances.

Requests and faults can be submitted 24/7. The helpdesk team operates 9-5 AEST.  Priority 2,3 and 4 reports are actioned during business hours.  Priority 1 reports are actioned 24/7.

9.    Service Requests that May Incur a Fee

In certain instances where Lucidity needs to invest time to investigate a service request that subsequently is identified as being an error or fault at the client end, then the time Lucidity spends investigating will be charged to the client.  These circumstances are listed in the table below.

10.    Professional Services

Lucidity is able to offer ongoing professional services to support client needs.  These services may include activities such as:

• Delivery of software training to administrators or the business as a whole
• Assisting with handover / transition, particularly when a new administrator commences
• Migration or other activities related to records or data, such as when significant business changes occur (i.e. acquisitions and mergers)
• Generating unique or custom reports or analysis
• Carrying out any task that an Administrator or team member would normally do, but for resource or time constraints would prefer that we undertake the task.

Our team can assist with any of the items listed above on an as-needs basis.  These services are provided on an hourly basis.  The cost of these services depends on the nature of the task being undertaken - please let us know your requirements and we can prepare a proposal.

11.    Ceasing a Service

Should a client no longer wish to use Lucidity software, we delete all client data held on our servers after confirmation in writing from the client that they wish us to do so.  In the case where confirmation is not received, we retain the data for a period of one year and then delete the data.  This includes all backups held for recovery purposes. 

Clients can access their data in a number of ways in preparation for ceasing a service:

• We can provide a database copy
• We can provide a client IT Administrator with read-only access to their database, for the purposes of making a copy (or doing other analysis)
• Clients can export their data through the applicable Lucidity Software application (i.e. excel reports etc) to obtain their data.

If a client has other needs at the end of a service with respect to their data, please contact us with your requirements.