Governance, legal, and risk
Vendor SLA (takedown)
A takedown SLA is the set of time and outcome commitments a vendor or internal team makes for handling abuse: how quickly a report is acknowledged, how quickly it is filed with a provider, and how removal is measured.
The definitions matter more than the numbers
Two vendors can both promise a 24-hour takedown and mean different things. One counts from detection, the other from the customer's approval. One counts a provider's acknowledgement as done, the other waits until the page no longer loads. Before comparing numbers, agree on when the clock starts, when it stops and what evidence proves it stopped.
Metrics worth putting in a contract
- Time from detection to first report to a provider.
- Time from first report to the content being unreachable, verified from outside.
- Share of cases that recur on the same or related infrastructure within a set period.
- Completeness of the evidence package attached to each report.
Limits
No vendor controls a registrar's or a platform's response time, so a takedown SLA can only bind the parts the vendor performs: speed of filing, quality of evidence, persistence of follow-up. Treat any promise about the provider's side as a historical average, and ask for the data behind it.
Related terms
Sources
- ICANN: reporting abuse to registrars and registries
- NIST SP 800-61 Rev. 3: incident response recommendations
External guidance is general. Adapt it to your legal, regulatory and operational requirements.