1. Purpose

Technology is only secure when both sides hold up their end. This Policy exists to make clear, specifically, what Provider is responsible for maintaining and what Client is responsible for doing — so that if something goes wrong, there’s no ambiguity about where the gap was.

2. Provider Security Commitments

Provider maintains the following as part of the managed services delivered under the Agreement:

• 24/7 monitoring of covered endpoints, servers, and network infrastructure
• Endpoint detection and response (EDR) and email security tooling appropriate to Client’s environment
• Regular patch management for covered devices and supported software
• Backup configuration and periodic recovery testing for covered systems
• Documented findings and recommendations delivered through vCIO reports and Technology Alignment Meetings (TAMs)
• Prompt notification to Client of any confirmed security incident affecting Client’s environment

These commitments apply only to systems, devices, and accounts explicitly covered under the Agreement’s Services and Pricing section or an attached Scope of Work. Unmanaged or “bring your own” devices connected to Client’s network are outside this coverage unless separately contracted.

Backup configuration and recovery testing are performed as part of the operational services described above; they do not expand Provider’s liability beyond what is set out in the Master Services Agreement and General Terms and Conditions, which govern data loss and limitation of liability.

3. Client Security Responsibilities

Client agrees to the following as a condition of the Agreement remaining in force:

• Multi-factor authentication (MFA) enabled on all accounts where Provider has made it available, without exception
• Password standards — unique, non-shared credentials for all business accounts, meeting the minimum complexity standards Provider communicates from time to time
• User access hygiene — promptly notifying Provider of employee terminations, role changes, or any other event that should trigger an access change
• No circumvention of security controls, monitoring agents, or endpoint protection tools installed by Provider
• Reporting — notifying Provider immediately upon suspecting a phishing attempt, credential compromise, lost or stolen device, or any other potential security event, rather than attempting independent remediation first
• Following vCIO and TAM recommendations related to security posture, or documenting in writing the decision not to, so that risk acceptance is on record rather than assumed

Security is a shared responsibility. Provider cannot secure an environment where these baseline practices aren’t followed, and gaps caused by Client’s non-compliance with this section are not attributable to Provider’s service delivery.

4. Acceptable Use of Systems, Software, and Automation

Client and Client’s authorized users may use the systems, software, and automation provided under the Agreement only for legitimate business purposes consistent with the scope of services. The following are prohibited without Provider’s prior written approval:

• Reverse-engineering, cloning, copying, reselling, extracting, or replicating any part of Provider’s system architecture, automation, workflows, or proprietary configurations
• Installing, removing, or reconfiguring hardware, software, network settings, or security controls on Provider-managed systems
• Sharing login credentials, API keys, or access tokens outside of authorized users
• Using provided systems to store, transmit, or process unlawful content, or to violate the rights of any third party
• Connecting unauthorized or unmanaged devices to a network segment Provider is responsible for securing
• Attempting to bypass usage limits, rate limits, or fair-use thresholds on AI, automation, or compute-based tools

5. Fair Use — AI, Automation, and Compute

Where the Agreement includes AI-enabled tools, automation workflows, or compute-based services, usage is expected to stay within reasonable business volume for Client’s organization size, consistent with the tier or plan Client is subscribed to. Provider may, at its sole discretion:

• Monitor usage volume, compute intensity, and request frequency
• Apply reasonable rate limits to prevent service degradation for other clients
• Bill additional usage in arrears, in accordance with the current Rate Schedule, for consumption materially exceeding what’s typical for Client’s plan
• Temporarily throttle or suspend a specific automation or workflow that is degrading system performance, with notice to Client where practical

This is not intended to restrict normal business use — it exists to keep shared infrastructure stable for every client on the platform.

6. Incident Reporting

If Client becomes aware of, or reasonably suspects, a security incident — including but not limited to unauthorized access, data exposure, ransomware, or a compromised account — Client must notify Provider as soon as reasonably possible through the emergency/critical channel defined in Provider’s Service Level Agreement. Delayed reporting can materially limit Provider’s ability to contain an incident and is a relevant factor in any post-incident review.

7. Enforcement

Violation of this Policy may result in one or more of the following, at Provider’s sole discretion and proportionate to the severity of the violation:

• A warning and request for corrective action
• Temporary suspension of the affected service, tool, or account
• Additional billing for excess usage or remediation work required as a result of the violation
• Immediate termination of the Agreement, consistent with the Master Services Agreement, for breach of this Policy, unauthorized modification of Provider-managed systems, or misuse of system components

8. Policy Updates

Provider may revise this Policy periodically to reflect changes in the threat landscape, tooling, or service delivery standards. Material changes will be reflected on this page with an updated “Last Updated” date. Continued use of Provider’s services after a revision constitutes acceptance of the updated Policy