MerchantE vs Omise vs VPC SLA Comparison
Executive Summary
DECISION SUPPORT
This page compares the currently available SLA position of MerchantE, Omise, and VPC / Cybersource across monitoring, incident notification, mitigation, RCA timing, uptime commitments, maintenance practices, service credits, and change management. The goal is to identify where MerchantE is stronger, where it is less explicit, and what should be clarified before using MerchantE language in a customer-facing SLA.
Key takeaway: MerchantE appears operationally mature, especially in monitoring depth and P1 incident handling, but its currently documented SLA language is less complete and less contract-ready than Omise and VPC in several areas such as severity-wide notification commitments, mitigation targets beyond P1, and service credit language.
Current Status
- Use this comparison as an internal reference for SLA drafting and negotiation support.
- Do not use the current MerchantE operational summary as external contractual language without review by business and legal teams.
- Prioritize closure of gaps in notification matrix, mitigation commitments for P2-P4, uptime exclusions, and service credits.
Comparison Criteria
The comparison focuses on the items most likely to matter in merchant, partner, and enterprise negotiations:
Monitoring coverage
Incident notification model
Mitigation / restoration commitments
Severity classification clarity
RCA turnaround time
Uptime commitment
Maintenance and resilience practices
Service credit clarity
Change management ownership
Side-by-Side SLA Comparison
Category | MerchantE | Omise | VPC / Cybersource |
|---|---|---|---|
Monitoring | 24/7/365 platform monitoring across gateway, auth, settlement, database, file transfer, and support services using Icinga2, Prometheus, CloudWatch, Splunk, and AllQuiet. | 24/7/365 SOC monitoring. Primary tools: Datadog and Sentry. Includes anomaly thresholds and latency monitoring with backends and bank acquirers. | 24/7/365 platform monitoring for incident detection. Specific toolset not detailed in the SLA excerpt, but supported by Visa operational continuity and recovery programs. |
P1 notification | P1 process documented internally. Incident Manager creates MPI ticket and triggers AllQuiet for Business War Room within 20 minutes of initial P1 notification. Hourly updates documented internally as well, if incident exceeds 20 minutes, Incident Coordinator sends the incident notification. | Immediate status page message. Solution Consultant contacts top merchants immediately. If incident exceeds 10 minutes, Incident Coordinator activates and Marketing emails merchants. Hourly status page updates until resolved. | Email notice for P1 incidents that continue more than 15 minutes, with optional SMS. Updates every 30 minutes until resolved if that does not interfere with resolution. |
P2-P4 notification | P2 email within 30 minutes. No notification for P3 or P4. | P2 status page update when impact reaches about 40%+ of each payment method. No immediate external notification for P3 or P4. | P2 email within 30 minutes. No notification for P3 or P4. |
P1 mitigation target | Within 1 hour. | Within 1 hour. Breakdown: 10 minutes detect, 10 minutes report, 40 minutes mitigate. | Within 1 hour. |
P2 mitigation target | Within 4 hours provide a fix or reasonable workaround. | Within 2 hours. | Within 4 hours provide a fix or reasonable workaround. |
P3 mitigation target | Within 30 business days provide a remediation plan or workaround, with commercially reasonable efforts to fix within 60 calendar days. | Within 1 business day. | Within 10 business days provide a remediation plan or workaround, with commercially reasonable efforts to fix within 60 calendar days. |
P4 mitigation target | Commercially reasonable efforts within 180 calendar days. | No specific target. | Commercially reasonable efforts within 180 calendar days. |
Severity definitions | Clear P1-P4 classification table with transaction impact thresholds and business effect descriptions. | Clear P1-P4 classification table with transaction impact thresholds and business effect descriptions. | Clear P1-P4 labels and response expectations, though classification detail is lighter than Omise. |
P1 RCA timeline | 24 hours after fix acceptance for P1, based on internal summary. | No later than 3 working days after incident resolution. Format: merchant email plus internal postmortem. | No later than 12 hours after restoration. Format: email or written document. |
Uptime commitment | Quarterly uptime targets by service tier: Tier 1 99.99%, Tier 2 99.95%, Tier 3 99.00%, Tier 4 95.00%. | Quarterly uptime targets by service tier: Tier 1 99.99%, Tier 2 99.95%, Tier 3 99.00%, Tier 4 95.00%. | States 99.999% uptime. Specific SLA availability rate is negotiated. |
Maintenance posture | Deployment windows, freeze periods, rollback plans, CAB, Blue-green deployment, Feature Flags. | Deployment windows, freeze periods, rollback plans, CAB, and 99.5% deployment success without rollback. | 24/7 support, planned maintenance with no downtime, redundant data centers, replication, backup and restoration, and ro |