Software SLAs in Dubai (2026): What 99.9% Uptime Really Buys, and Why Service Credits Rarely Pay
99.9% uptime allows 43 minutes of downtime a month, and the credit it pays is usually 10% of one invoice. What Dubai SLAs really cover in 2026, with the AED math.
- PUBLISHED
- 26 OCT 2026
- READ TIME
- 11 MIN
- AUTHOR
- AQUARIUS · DUBAI
- UNIT
- REV 2026.09
A 99.9% uptime SLA does not mean your system stays up. It means your vendor is allowed 43 minutes of downtime every month, 8 hours 46 minutes every year, and if they blow past it the standard payout is a 10% credit on one month of fees, not compensation for your lost revenue. In 2026 that gap matters more in the UAE than it used to: Federal Decree-Law No. 25 of 2025 came into force on 1 June 2026 and moved pre-agreed compensation from Article 390 to Article 340, giving UAE courts a structured framework for adjusting the very caps vendors rely on.
Most Dubai businesses sign the SLA page without reading it, then discover during an outage that the document was written to limit the vendor liability rather than protect the buyer. This guide shows the real arithmetic, the 2026 benchmark numbers, the clauses that actually bite, and the AED ranges you should expect to pay for each availability tier.
The stakes: outages got more expensive, not less
Three numbers set the context before you argue about decimal places.
- 57% of organisations say their most recent major outage cost more than USD 100,000 and one in five put it above USD 1 million, for the second year running, according to the Uptime Institute Annual Outage Analysis 2026. Per-site outage rates have fallen for five consecutive years, but the cost per incident keeps edging up.
- Roughly two-thirds of publicly reported outages trace back to third-party IT and data-centre providers across nine years of Uptime Institute tracking: cloud platforms, telcos and colocation operators. In other words, the outage that takes your Dubai storefront down will most likely not be your own code.
- Microsoft 365 recorded 99.526% uptime in Q1 CY2026, the lowest quarterly figure since tracking began in 2013, down from 99.954% in Q4 CY2025. Even hyperscalers miss their own 99.9% commitment, and they are the benchmark your Dubai vendor is quietly copying.
Local exposure is not theoretical. The UAE e-commerce market is tracking around USD 12.3 billion (roughly AED 45 billion) in 2026 on Mordor Intelligence numbers, with online now about 15.7% of UAE retail. Dubai IT providers put SME losses during an unplanned outage at AED 10,000 to AED 50,000 per hour, and ITIC 2025 data puts the median mid-market firm of 200 to 1,000 staff at USD 2,400 per minute, about AED 8,800 a minute. Against those figures, a 10% credit on an AED 6,000 retainer is a rounding error.
Most Dubai businesses get this wrong: they negotiate the uptime percentage and ignore the remedy. The percentage is marketing. The remedy clause is the contract.
What each uptime number actually allows
Availability is measured against calendar time. A 30-day month contains 43,200 minutes and a year contains 525,600, so the allowance converts cleanly. Print this table and hold your vendor proposal next to it.
| Uptime commitment | Allowed downtime / month | Allowed downtime / year | Realistic fit |
|---|---|---|---|
| 99.0% ("two nines") | 7 hrs 12 min | 3 days 15 hrs | Internal tools, brochure sites. Unacceptable for revenue systems. |
| 99.5% | 3 hrs 36 min | 1 day 19 hrs | Single-server setups. AWS EC2 single-instance SLA sits here. |
| 99.9% ("three nines") | 43 min 12 sec | 8 hrs 46 min | The default for SME websites, apps and SaaS. Microsoft 365 baseline. |
| 99.95% | 21 min 36 sec | 4 hrs 23 min | E-commerce, booking, payments. Needs multi-AZ and a managed database. |
| 99.99% ("four nines") | 4 min 19 sec | 52 min 36 sec | Multi-AZ clusters. AWS EC2 region-level and Google Compute multi-zone commitment. |
| 99.999% ("five nines") | 26 sec | 5 min 15 sec | Telecom-grade. Microsoft only offers it on Teams Phone and calling plans. |
Two practical readings. First, the jump from 99.9% to 99.99% is not a 0.09% improvement, it is a ten-fold reduction in your downtime budget and it usually doubles or triples infrastructure cost, because it forces redundancy across availability zones. Second, nobody can promise 99.99% on a single server in a single data centre, no matter what the proposal says. If the architecture diagram has one box, the number is fiction. That is exactly what load testing before Dubai peak traffic is designed to expose before White Friday does it for you.
Why service credits almost never pay for the damage
A service credit is a percentage discount applied to a future invoice, not a cash refund and not damages. Here is what the vendors your Dubai supplier benchmarks against actually pay, taken from their published 2026 SLAs.
| Provider | Commitment | Credit tiers | Max credit |
|---|---|---|---|
| Amazon EC2 (region, multi-AZ) | 99.99% | 10% below 99.99%, 30% below 99.0%, 100% below 95.0% | 100% of that service fee |
| Google Compute Engine (multi-zone, Premium) | 99.99% | 10% below 99.99%, 25% below 99.0%, 100% below 95.0% | 100%, capped at the affected region fees |
| Microsoft 365 (per service, per month) | 99.9% | 25% below 99.9%, 50% below 99.0%, 100% below 95.0% | 100% of that service fee |
| Atlassian Cloud Premium / Enterprise | 99.9% / 99.95% | Tiered by shortfall | Capped at 50% |
| GitHub Enterprise Cloud | 99.9% | Tiered, claim within the quarter | Capped at 25% |
| Twilio APIs (standard) | 99.95% | Tiered by shortfall | Capped at 10% |
Now the arithmetic a Dubai operator should run before signing. Say you pay AED 6,000 a month for hosting plus support and your platform is down for nine hours in one month. Your uptime for that month is 98.75%, which lands in the second credit tier. At a 25% credit you receive AED 1,500 against next month invoice. On the conservative end of the Dubai SME loss range, nine hours of downtime costs you AED 90,000. The credit covers 1.7% of the damage.
Three clauses make it worse, and all three are standard:
- You must claim. Credits are rarely automatic. AWS requires the request to arrive "by the end of the second billing cycle after which the incident occurred", with incident times, resource IDs and request logs that corroborate the outage. GitHub works on a 90-day quarter window. A credit you never claim is worth nothing, and nobody files the paperwork while firefighting.
- Exclusions swallow the clause. Scheduled maintenance, anything caused by your own configuration, your own equipment or software, third-party dependencies, force majeure and suspension for non-payment are all carved out. Cap total excluded maintenance at a specific number of hours per month, or the exclusion is unlimited.
- Measurement is the vendor own. If the vendor defines, measures and reports availability from inside their own network, they also decide when the outage started. Insist on an independent external monitor and a public status page obligation. Pair it with real APM and observability tooling so you have your own timeline when the dispute starts.
The 2026 UAE legal change nobody told you about
Service credits are, legally, pre-agreed compensation. On 1 June 2026, Federal Decree-Law No. 25 of 2025 came into force and replaced the 1985 Civil Code, moving the agreed-compensation provision from the old Article 390 to Article 340. Under the old regime a UAE judge could vary an agreed sum, on the application of either party, so that it matched the actual loss, and any agreement to the contrary was void. The new Article 340 keeps that supervisory power but channels it: a court may reduce the agreed sum where the obligation was partly performed or where the creditor contributed to the loss, while an increase above the contractual figure needs proof of fraud or gross fault.
What that means commercially for a Dubai buyer:
- The law is prospective. Contracts concluded on or after 1 June 2026 fall under the new code, earlier contracts stay under the 1985 Code. If your software or hosting agreement renews this year, it is being re-papered under new rules whether you noticed or not.
- A credit cap is a commercial shield, not an absolute one. Pre-agreed compensation has always been reviewable by a UAE court or tribunal, and in practice adjustments are rare and increases rarer still. Treat the cap as what you will realistically get, and manage the rest with architecture, not litigation.
- Separate the remedies. Keep service credits for routine misses, and add a hard termination right for repeated breach, for example three consecutive months below the SLO or any single outage beyond a stated number of hours. A right to exit is worth more than a 10% credit, and it is what gives the credit clause teeth.
This is commercial guidance, not legal advice. Have UAE counsel review the final wording, and pair the termination right with a source code escrow arrangement so exercising it does not strand your platform.
What a Dubai SLA should actually say
Availability percentage is one line out of ten that matter. A usable SLA for a UAE web or app platform specifies:
- Definition of downtime, per service rather than aggregated across the whole platform, so a dead checkout cannot be averaged away by a healthy marketing site.
- Measurement method and source, with an external monitoring tool named and a one-minute or five-minute check interval stated.
- Severity matrix with separate response and resolution targets. Dubai managed-service providers advertise P1 response in 5 to 30 minutes and on-site response in 2 to 4 hours, so there is no reason to accept a vague "best effort".
- Support window and timezone, written in Gulf Standard Time, with Friday-evening and Ramadan peak coverage spelled out explicitly.
- Automatic credits applied by the vendor without a claim, with a monthly availability report delivered unprompted.
- RTO and RPO for disaster recovery, backup frequency, restore testing cadence, and where backups physically sit for UAE data-residency purposes.
- Change and release discipline, because most self-inflicted outages are deployments. Feature flags and canary releases belong in the SLA, not just the engineering wiki.
- Termination for repeated breach, plus data export in a documented format on exit.
Get these into the tender document rather than arguing after award. Our guide to writing a software RFP and scope of work in Dubai covers how to score vendors on them.
What availability costs in Dubai, in AED
Higher nines are an infrastructure bill plus a staffing bill. Indicative 2026 Dubai market ranges for a mid-sized web or app platform, excluding one-off build cost:
| Tier | Target | What it takes | Monthly AED |
|---|---|---|---|
| Basic AMC | 99.0% to 99.5% | Single VPS, daily backups, business-hours support, next-business-day response | 1,300 - 3,500 |
| Business | 99.9% | Managed database, external uptime monitoring, staging environment, 1 to 4 hr P1 response | 3,500 - 9,000 |
| High availability | 99.95% | Multi-AZ, load balancer, read replica, APM, 24/7 on-call rota, quarterly restore test | 9,000 - 25,000 |
| Mission critical | 99.99% | Multi-region or multi-AZ active-active, automated failover, error budgets, game days | 25,000 - 70,000+ |
The honest decision rule is an expected-value one. If an hour of downtime costs you AED 20,000 and moving from 99.9% to 99.95% removes about 21 minutes of exposure per month, roughly 4 hours 23 minutes a year, you are buying back about AED 87,000 of annual risk. Paying AED 10,000 a month extra for that is bad business. Paying AED 2,500 a month extra is obviously good. Run the number for your own revenue per hour before you buy nines you do not need, and check it against our breakdown of what Dubai website maintenance fees actually cover.
How Aquarius writes SLAs
We put availability in writing with the measurement method named, credits applied automatically without a claim, per-service rather than averaged uptime, and a monthly report you receive whether or not you ask. Severity targets are in Gulf Standard Time with Friday and Ramadan peaks covered. Disaster recovery carries stated RTO and RPO figures with a restore test on the calendar, not a promise. And every contract includes a documented data-export route on exit, because a vendor who is confident about uptime has no reason to make leaving hard.
If you are renewing a hosting or AMC contract this year, that renewal now sits under the new Civil Transactions Law, which makes it the cheapest moment you will get to fix the remedy clause. See our pricing, review the services we support, or send us your current SLA and we will mark up the three clauses that would cost you most during a real outage.
FAQ
Is 99.9% uptime good enough for a Dubai e-commerce site?
Usually not. 99.9% permits 43 minutes of downtime a month, and if those minutes fall on a Friday evening or during the Dubai Shopping Festival the revenue loss dwarfs any credit. For checkout and payment paths, target 99.95% as a minimum and architect for multi-AZ.
Are service credits paid in cash?
Almost never. Every major provider issues credits against future invoices for the affected service, and several cap the maximum well below 100%: Atlassian at 50%, GitHub at 25%, Twilio at 10%. Google Workspace pays in free service days rather than money.
Do I have to claim a service credit myself?
With most vendors, yes, and within a deadline. AWS requires the request by the end of the second billing cycle after the incident, with timestamps, resource IDs and corroborating logs. Negotiate automatic credits into any new UAE contract so the obligation to file does not sit with you.
Can a UAE court override the credit cap in my contract?
Agreed compensation has always been reviewable in the UAE. Under Article 340 of Federal Decree-Law No. 25 of 2025, in force since 1 June 2026, a court may reduce the agreed sum for partial performance or where the claiming party contributed to the loss, and may increase it only on proof of fraud or gross fault. Adjustments are rare in practice, so design the contract to work without one.
What uptime do UAE hyperscaler regions actually commit to?
The same global figures: 99.99% monthly for EC2 across two or more availability zones, 99.5% for a single instance, 99.99% for Google Compute Engine multi-zone on Premium Tier. Deploying in a UAE region changes latency and data residency, not the SLA percentage.
The takeaway: stop negotiating the percentage and start negotiating the remedy. Fix the measurement method, kill the claim requirement, cap the exclusions and add a termination trigger. Then spend the money you were going to spend on a fourth nine on redundancy that prevents the outage instead of compensating you for it. Talk to Aquarius about an SLA that survives a bad Friday.