Context
This document provides information on the campaigns Add-On software component for CoreMedia Content Cloud – Service (“CoreMedia Campaigns”).
CoreMedia Campaigns provides a user interface for business users to schedule and manage content marketing campaigns across their websites. The Campaign Data is stored in a backend service. Subscribers can integrate CoreMedia Campaigns in their web applications via Application Programming Interfaces (APIs).
Definitions
1. “Campaigns API” means Application Programming Interface and is a set of rules that allow applications developed by the subscriber to communicate and interact with CoreMedia Campaigns. It defines how developers can request and exchange information between their application and CoreMedia Campaigns.
2. “Campaign Data” means campaign scheduling data with references to Content UUIDs from the customer’s CoreMedia Content Cloud – Service environment.
3. “Content UUID” is the Universal Unique Identifier of content from the subscriber’s CoreMedia Content Cloud – Service environment. It does not include any editorial data and is solely a reference.
4. “Overage API requests” means API requests to CoreMedia Campaigns Delivery API which exceeds the included number of API requests as set out in the relevant Order Form. If the amount of API requests included in the subscription (accumulated during the month) is exceeded, then “Overage API requests” will be charged monthly, based on the then applicable price list without the need of a further Order Form.
5. “Tenant” means a logical separated unit to which Campaign Data belongs to. One subscriber can use multiple tenants to separate Campaign Data for use with multiple CoreMedia Content Cloud – Service environments.
On-boarding
Introduction
The CoreMedia on-boarding team will initiate the on-boarding following the signature of the agreement. This includes
· Definition and configuration of eligible user groups for using CoreMedia Campaigns
· Creation of Tenants for the different Environments of the Subscriber
Scope
On-boarding includes the following services:
· CoreMedia Content Cloud – Service environments defined in the Agreement will be configured and re-deployed to use CoreMedia Campaigns
· CoreMedia Content Cloud – Service environments defined in the agreement will be provisioned, set up and configured with Tenant IDs, corresponding API keys and agreed group-configuration
Deliverables
The CoreMedia on-boarding team will provide the following deliverables as part of the on-boarding:
· CoreMedia Campaigns system URLs
· Tenant IDs and corresponding API keys for accessing delivery and preview APIs
Cloud Infrastructure
Environments
CoreMedia Campaigns is a multi-tenant Software as a Service (SaaS). It offers a single Production Environment that is accessed using different users and API keys belonging to a Tenant.
A Tenant can either be bound to a specific CoreMedia Content Cloud – Service environment or shared between different environments (e.g. UAT and PROD).
Data Centers
CoreMedia deploys CoreMedia Campaigns to data centers operated by public cloud vendors (such as for example Amazon Web Services). These data centers are operated in alignment with the Tier III+ guidelines (as per the Uptime Institute classification).
Storage
Overview
CoreMedia Campaigns stores
· campaign scheduling data with references to Content UUIDs from the Subscriber’s CoreMedia Content Cloud – Service environment
· application logs in a dedicated log storage service
· access logs and metrics to identify API usage per subscriber and to determine system health, support diagnostics, and to solve incidents.
The backup and restore policies and procedures for this data are described in section 5.1 Backup and Restore.
Limits
CoreMedia Campaigns include a certain amount of API requests per month against the campaigns delivery API, depending on the commercial contract. When exceeding this monthly limit, additional overage charges will apply according to the commercial contract. In general, Overage API Requests will not be blocked.
CoreMedia Campaigns uses shared cloud-services across all Tenants and subscribers. CoreMedia will use commercially reasonable efforts to provide enough capacity across all Tenants to cover peak request amounts.
In order to prohibit for example denial-of-service (DoS) attacks and unwanted excessive usage of the API, CoreMedia might enforce short-term rate limits (e.g. number of API requests per Tenant/IP per minute). These rate limits will be announced to the Subscriber in advance.
Access
All access to CoreMedia Campaigns is facilitated via secure and encrypted connections.
Backup and Restore
Scope
Backups are generally hosted in a different data center. Backups are done on the complete multi-tenant database and not on individual Tenant’s data. The purpose of this backup is to roll-back the complete database in case of failed updates or outages of the service. It is not possible to undo tenant specific editorial changes or deletions.
Retention
Backup data is kept for at least 1 week.
Frequency
Back up is done at least every hour and before each update of the Service.
Restore Time Objective (RTO) and Restore Point Objective (RPO)
Restore can take up to one business day (RTO). Restore point objective (RPO) for user-managed content is one hour.
Scaling
CoreMedia Campaigns automatically scales based on dynamic load.
Network Services
CoreMedia uses monitoring software for key metrics and usage of the delivery API. Total delivery API usage per Tenant is reported to the Subscriber monthly.
Network services also include secure configuration of firewalls to prevent unauthorized access to CoreMedia Campaigns.
Support
See Exhibit 2 and 3 for CoreMedia Content Cloud - Service support terms.
Service Level
The Service Level Objective for CoreMedia Campaigns is 99.9% per month. Availability is determined by monitoring.
The following times are excluded from Availability:
· Failures caused by Subscriber adaptations or inappropriate use.
· Failures caused by third-party systems provided by the subscriber
· Failures caused by exceeding the usage or rate limits
· Planned and communicated maintenance times as stated in section “8. Maintenance”
There will be regular scheduled updates for product enhancements, bugfixes and program corrections.
Maintenance
CoreMedia will announce planned maintenance to all subscribers.
In case of emergencies, unscheduled updates can be made.
For some updates, such as updating the underlying database schema, modification and creation of new campaigns can be paused. CoreMedia will use commercially reasonable efforts to keep the campaigns delivery API unaffected and continuously respond to delivery API requests based on the previous data in those cases.
Access and Security
Access to Campaigns Resources
Only permanent and specially trained members of the CoreMedia Campaigns operations team are given access to a subscriber’s data (campaign scheduling data and references to content). Access is always secured by two-factor-authentication.
Network
Data transfer between the subscriber and Campaigns API is secured by transport encryption methods and authentication.
9.3 Application Security
See Service Description for CoreMedia Content Cloud - Service section “Application Security”.
Penetration Testing
See Service Description for CoreMedia Content Cloud - Service section “Penetration Testing”.
