Hyvä Storefront Pod SOW Worksheet

Outcome statement

Write: The supplier will deliver __________________ for __________________ stores and routes on __________________ edition and version using __________________ Hyvä products. The buyer will accept the work using Attachment ____.

________________________________________________________________

________________________________________________________________

Business constraints

• □ Revenue or release blackout: ________________________
• □ Required launch window: ____________________________
• □ Regulatory or accessibility need: ____________________
• □ Brand and content constraint: ________________________
• □ Integration or data constraint: _______________________
• □ Internal-team or vendor dependency: __________________

Included

• □ Websites, stores, views, domains: ____________________
• □ Pages, templates, states, routes: _____________________
• □ Hyvä products and versions: _________________________
• □ Modules, custom code, and services: __________________
• □ Design, content, migration, and data work: _____________
• □ Testing, release, stabilization, support: _______________

Excluded

• □ Backend features not touched: ________________________
• □ Data or content not migrated: _________________________
• □ Stores, routes, devices, or browsers excluded: __________
• □ Integrations or licenses excluded: _____________________
• □ Marketing, CRO, SEO, or analytics work excluded: ________
• □ Support after the stated period excluded: ______________

Substitution clause worksheet

• Minimum notice: ____________________________________
• Buyer approval before access: ________________________
• Evidence equal to or stronger than: ____________________
• Required overlap and transfer: ________________________
• Schedule and cost treatment: __________________________
• Right to reject or end affected work: ____________________

Working cadence

• Planning and demo cadence: __________________________
• Required overlap hours: ______________________________
• Decision-response time: ______________________________
• Issue and escalation channel: _________________________
• Repository and review rules: __________________________
• Time, allocation, and absence reporting: ________________

Discovery completion rule

• □ Critical routes are inventoried.
• □ Checkout combinations and failures are mapped.
• □ Custom code and package versions are known.
• □ Test-pending items have owners and due dates.
• □ Estimate assumptions and exclusions are visible.
• □ Buyer accepted residual risks or no-go conditions.

Estimate change rule

Write: If discovery shows __________________, the supplier will provide evidence and a change request covering scope, schedule, price, acceptance, and risk before affected implementation begins.

Buyer response time: _________________________________

Work allowed before approval: _________________________

Code and review rules

• □ Buyer-controlled repository and branch rules
• □ Commit, pull request, review, and merge authority
• □ Static analysis, tests, build, and security checks
• □ Code ownership, third-party licenses, and notices
• □ No secrets or production personal data in code or tickets
• □ Accepted dependency, patch, fork, and upgrade policy

Demonstration and decision rules

• □ Demonstration cadence and environment
• □ Required buyer participants
• □ Decision deadline and effect of delay
• □ Retained recording, notes, screenshots, or results
• □ Defect versus change-request boundary
• □ Accepted exception authority and expiry

Definition of done

• □ Included deliverables are complete and stored.
• □ Code is reviewed, merged, built, and traceable.
• □ Required tests pass or have approved exceptions.
• □ Critical defects are closed under the severity rule.
• □ Compatibility register matches the delivered build.
• □ Documentation and runbooks are current.
• □ Release rehearsal and rollback evidence are accepted.
• □ Access, IP, handover, and support duties are ready.

Defect and exception rule

• Severity definitions: __________________________________
• Release-blocking severities: ___________________________
• Response and fix targets: ______________________________
• Retest owner: ________________________________________
• Exception approver: ___________________________________
• Exception expiry and remediation: _______________________
• Dispute and independent review: _________________________

Assumption and dependency record

• Assumption or dependency: ____________________________
• Owner: _____________________________________________
• Evidence or due date: _________________________________
• If false or late: ______________________________________
• Work that can continue: _______________________________
• Change or stop authority: ______________________________

Change request record

• Change ID and requestor: ______________________________
• Reason and evidence: __________________________________
• Scope and deliverable effect: ___________________________
• People, schedule, and price effect: ______________________
• Acceptance and risk effect: _____________________________
• Approved by and date: __________________________________

Release preparation

• □ Production-like rehearsal and evidence
• □ Data, content, configuration, static assets, cache, index plan
• □ Freeze, backup, maintenance, communication, and vendor windows
• □ Final smoke suite and named testers
• □ Go or no-go checklist and authority
• □ Deployment and observation staffing

Rollback

• □ Rollback method and maximum decision time
• □ Trigger metrics, defects, integration failures, or business events
• □ Data and order reconciliation
• □ Cache, index, asset, configuration, and external-service recovery
• □ Rollback authority and executor
• □ Customer, internal, and vendor communication

Monitoring and incidents

• □ Availability, errors, logs, checkout, payment, integrations
• □ Performance, Core Web Vitals, analytics, consent, SEO signals
• □ Dashboards, alerts, recipients, thresholds, escalation
• □ Incident severity, response, update cadence, resolution evidence
• □ Third-party vendor escalation and account owner

Stabilization

• Start and end: ________________________________________
• Coverage hours: ______________________________________
• Included defects and exclusions: ________________________
• Response and resolution targets: _________________________
• Daily or weekly reporting: _______________________________
• Exit criteria and support receiver: ________________________

Access and security

• □ Named accounts, least privilege, approval, and expiry
• □ MFA, secrets manager, credential sharing prohibition
• □ Production data and personal-data boundary
• □ Device, network, repository, and vendor-access rules
• □ Security event and vulnerability reporting
• □ Access review and revocation evidence

IP and third-party materials

• □ Buyer-owned code, designs, content, data, and documents
• □ Supplier background materials and granted rights
• □ Open-source and commercial packages, licenses, notices
• □ Fonts, images, icons, code snippets, AI-assisted outputs
• □ Forks, patches, source access, update and support rights
• □ Assignment timing and acceptance condition

Documentation set

• □ Architecture, routes, modules, interfaces, decisions
• □ Local setup, build, test, deploy, rollback, monitor
• □ Theme, components, Tailwind, Alpine.js, content rules
• □ Checkout, payment, shipping, tax, fraud, external services
• □ Accessibility, performance, analytics, consent, SEO protocols
• □ Known issues, exceptions, risks, backlog, vendor contacts

Handover and offboarding

• □ Knowledge-transfer sessions, audience, recording, questions
• □ Code, assets, documents, reports, licenses, and decision logs
• □ Open defects, risks, changes, support and warranty duties
• □ Repository, cloud, vendor, analytics, design, and tool access
• □ Supplier account removal and buyer access verification
• □ Final handover review, acceptance, and transition date

Commercial basis

• □ Fixed price, time and materials, capacity, or hybrid
• □ Currency, rates or milestone amounts, taxes, expenses
• □ Included hours, roles, environments, vendors, licenses
• □ Timesheet, milestone, evidence, and invoice approval
• □ Overtime, out-of-hours release, travel, third-party cost
• □ Holdback, credit, cap, or remedy where agreed

Warranty and support

• Warranty start and end: _______________________________
• Covered defects: _____________________________________
• Excluded changes and external causes: __________________
• Severity, response, resolution, update: __________________
• Support hours, channel, and named receiver: ______________
• Transition to ongoing support: ___________________________

Suspension and termination

• □ Triggers, notice, cure, and immediate-stop conditions
• □ Payment for accepted work and disputed work
• □ Safe stopping point and production protection
• □ Code, documents, data, IP, licenses, and access return
• □ Transition help, rate, duration, and cooperation
• □ Confidentiality, privacy, security, and survival terms

Final close

• □ Deliverables and exceptions accepted
• □ Open defects and warranty owner transferred
• □ Handover evidence accepted
• □ Supplier access revoked and buyer access verified
• □ Final invoice and credits reconciled
• □ Contract, evidence, and decision archive complete

Review record

• Product review: _______________________________________
• Technical review: _____________________________________
• Security and privacy review: ____________________________
• Accessibility review: __________________________________
• Procurement and finance review: _________________________
• Legal review: _________________________________________

Approval record

• Buyer authorized signatory: _____________________________
• Date: _______________________________________________
• Supplier authorized signatory: __________________________
• Date: _______________________________________________
• Open conditions: ______________________________________
• Effective after: ________________________________________