Vantage Master Terms & Conditions Print

Document version 2.2 · effective 2026-04-01 · revised 2026-09-23 (Section 6.2 security baseline; Section 10.1 governing law and venue).

Governing law and venue: the laws of the State of New York; exclusive venue in Bronx County, New York (see Section 10.1).

These Master Terms & Conditions are the consolidated general terms governing all Vantage offerings. Each Offering Schedule adds offering-specific detail but cannot subtract from the protections stated here (see Section 11, Precedence & Inheritance). The Offering Schedules themselves are listed, with links, in Section 12.

Parties: 3VS / Vantage (“Vendor,” “Provider,” “3VS”) and the contracting client organization (“Client”).

Effective Date of this Master Terms document: 2026-04-01. The underlying component agreements referenced throughout (Master Services Agreement, Non-Disclosure Agreement, 3VS Service Level Agreement) are each recorded as executed 2025-12-15. This document states a single, reconciled version of those component agreements’ general terms.

1. Definitions and Interpretation

• “Agreement” means, collectively, this Master Terms document, the Master Services Agreement (MSA), the 3VS Service Level Agreement (SLA), the Non-Disclosure Agreement (NDA), each executed 2025-12-15, and any Offering Schedule and Section-06 Engagement/Order Form entered under them.
• “Offering Schedule” or “Schedule” means a product- or service-specific terms document (the 22 schedules listed in Section 12) that adds detail to, but does not override, these Master Terms.
• “Section-06 Engagement” or “Work Authorization” means the order-form-level document (see Section 11) that specifies the commercial particulars of a given engagement: subscription tier, term, activation date, billing cycle, and named schedules in scope.
• “Client Data” means all data, content, configurations, credentials-adjacent metadata, and information Client or its systems provide to, or that is generated about Client by, the Services.
• “Confidential Information” has the meaning given in the NDA and includes, without limitation, Client Data, security findings, pricing, and Vendor’s methodologies and tooling.
• Headings are for convenience only. “Including” means “including without limitation.” “Days” means calendar days unless a Schedule specifies “business days.”

2. Order of Precedence

Where any two governing documents conflict, resolve the conflict using this order, highest first:

1. A signed Amendment, Change Order, or Statement of Work executed by both parties specifically superseding a named provision.
2. The Master Services Agreement (MSA) — general commercial, legal, dispute-resolution, and risk-allocation terms.
3. This Master Terms document — the consolidated statement of MSA-level defaults for billing framework, IP, confidentiality, liability, warranties, and precedence, reconciling the 22 Offering Schedules into one authoritative baseline.
4. The 3VS Service Level Agreement (SLA) — availability, performance, incident response, and service-credit mechanics common to all Vantage services.
5. The Non-Disclosure Agreement (NDA) — confidentiality and data-protection baseline.
6. The applicable Offering Schedule — product-specific scope, fees, and operational detail; may ADD detail but may not lower a liability cap, narrow a confidentiality obligation, or shorten a notice period set at a higher tier without an explicit, mutually signed carve-out.
7. The Section-06 Engagement / Order Form — the specific commercial instance (tier, term, activation date, price) that invokes the above framework for a given Client.
8. General Vantage platform Terms of Service, Acceptable Use Policy, and published documentation — baseline default where nothing above addresses the point.

Where an individual Offering Schedule states its own precedence ranking, this Section 2 controls as the default ladder (MSA > Master Terms > SLA > NDA > Schedule), while each Schedule keeps the right to control narrow, schedule-specific operational mechanics (for example, a schedule’s own SLA numbers) where the SLA is silent.

3. Billing Framework

3.1 General. Fees for each Offering are as stated in the applicable Schedule and/or Section-06 Order Form. Except where a Schedule states otherwise, invoices are due Net 30 from invoice date.

3.2 Late payment. Interest accrues on overdue amounts at 1.5% per month (18% APR), or the maximum rate permitted by law if lower.

3.3 Suspension for non-payment. Vendor may suspend the affected Service if payment is not received within 30 days of the due date, following written notice. Where a Schedule specifies a different suspension trigger for its own service (for example, 15 days), the Schedule’s own number controls for that Service only, subject to Section 2.

3.4 Taxes. All fees are exclusive of sales, use, VAT, GST, and similar taxes. Client bears these unless it furnishes a valid exemption certificate.

3.5 Price increases. Absent a different figure in the applicable Schedule, Vendor may increase recurring fees on renewal upon 60 days’ written notice, and Client may terminate the affected Service without penalty if it rejects the increase by written notice within the notice window. Schedules that specify a different cap (for example, 5%, 10%, CPI+5%) or notice period (90 days) control for that Service.

3.6 No refunds; proration. Fees are non-refundable once invoiced or once the billing period has commenced, except (a) as required by law, (b) as stated in a Schedule’s own termination-for-cause remedy, or (c) pro-rata credit expressly provided on Vendor-initiated termination for convenience.

3.7 Weighted-asset / ITAM billing. Certain Offerings (FinOps, Right-sizing Retainer) bill against a weighted-asset count rather than flat per-unit fees, per the ITAM weight table in the applicable Schedule. A discrete resource is billed once at its assigned weight regardless of how many Vantage services touch it, to avoid duplicate billing across overlapping Offerings.

4. Intellectual Property

4.1 Client materials. Client retains all right, title, and interest in Client Data, Client-owned systems, and Client-authored content submitted to any Service.

4.2 Vendor materials. Vendor retains all right, title, and interest in the Vantage platform, its underlying software, methodologies, schemas (including the Vantage Infrastructure report/commercial schema suite), monitoring agents, dashboards, and all improvements, aggregated/de-identified analytics, and derivative works thereof. Client receives only the limited, non-exclusive, non-transferable, non-sublicensable license needed to use the Services during the applicable term, as further detailed in each Schedule.

4.3 Feedback. Any feedback Client provides regarding a Service may be used by Vendor to improve its offerings without obligation or attribution, and without granting Client any ownership interest in resulting improvements.

4.4 Reports and deliverables. Reports, findings, and advisory deliverables prepared specifically for Client are Vendor work product in which Client receives a durable internal-use license (typically 3 years unless a Schedule states otherwise); Vendor’s underlying methodology, frameworks, and tooling are never assigned to Client.

5. Confidentiality

5.1 Baseline. All information exchanged in connection with the Agreement — Client Data, security findings, pricing, schemas, and Vendor methodology — is Confidential Information under the NDA and shall be protected with no less than a reasonable-care standard, and no less protection than each party gives its own confidential information of like kind.

5.2 Permitted disclosure. Confidential Information may be disclosed only to personnel and subprocessors with a need to know, bound by confidentiality obligations at least as protective as this Master Terms document, or as required by law/valid legal process (with notice to the disclosing party where legally permitted).

5.3 Survival. Confidentiality obligations survive termination for the period stated in the NDA. Where a Schedule states a different period (Schedules range from 1 to 7 years, with several stating “indefinitely” for trade secrets), the NDA’s term controls unless the Schedule’s period is longer, in which case the longer period controls. A Schedule’s shorter period never cuts off an NDA obligation early.

6. Data Handling & Privacy

6.1 Roles. Except as a Schedule specifies otherwise, Client is the data controller and Vendor is the data processor with respect to any personal data processed in connection with the Services. Vendor processes such data only per Client’s documented instructions and the DPA/SCCs incorporated by reference where applicable.

6.2 Security baseline. Vendor encrypts Client Data in transit (TLS 1.2+) and at rest (AES-256 or equivalent), and maintains access controls and audit logging consistent with the sensitivity of the data processed. Security controls and any applicable attestations are described in the Vantage Managed Security Services Schedule (Section 6, Data Handling) and in the Data Handling section of each applicable Offering Schedule listed in Section 12.

6.3 Breach notification. Vendor notifies Client of a confirmed or reasonably suspected data breach involving Client Data without unreasonable delay, and in any case no later than the shortest window committed in any applicable Schedule (Schedules range from 24 to 72 hours); absent a shorter Schedule commitment, the default is 72 hours from discovery.

6.4 Retention and deletion on termination. Absent a longer Schedule-specific commitment, Vendor retains Client Data for 30 days post-termination to permit export, after which it is securely deleted or cryptographically erased, subject to legal-hold and backup-retention exceptions (typically up to 90 days for backup copies only, not for active use).

6.5 Subprocessors. Vendor may use subprocessors bound by confidentiality/data-protection terms at least as strict as this Master Terms document, and will provide notice of material subprocessor changes (typically 30 days), during which Client may object; unresolved objections entitle Client to terminate the affected Service without penalty.

See also the Vantage Privacy Policy, which describes how 3VS handles personal information collected through its website, client portal, billing, and support channels.

7. Liability Cap

7.1 General cap. Except for the carve-outs in 7.3, each party’s total aggregate liability arising out of or related to a given Offering Schedule and this Agreement shall not exceed the fees paid by Client for that Offering in the 12 months immediately preceding the event giving rise to liability.

7.2 Where a schedule states a different cap. Several Offering Schedules state a fixed-dollar floor or alternative formula, including:

• $50,000 floor — Dark Web Monitoring; Managed Backup & Disaster Recovery
• $10,000 flat cap — Endpoint & Device Posture Management
• $1,000 floor — Security Awareness Training; AI/ML Threat Detection
• $500 floor — Right-sizing Retainer

Where a Schedule states a different cap or floor for its own Offering, the Schedule’s number controls for that specific Offering only; this Master cap governs any Offering silent on the point, and no Schedule may waive or exceed the Master cap upward without an express, mutually signed amendment.

7.3 Carve-outs (uncapped or separately governed). The cap in 7.1 does not apply to:

1. either party’s indemnification obligations (Section 9);
2. breach of confidentiality obligations (Section 5 / NDA);
3. infringement of intellectual property rights;
4. either party’s gross negligence, willful misconduct, or fraud;
5. Client’s payment obligations;
6. liability that cannot lawfully be limited or excluded.

7.4 Consequential damages. Neither party is liable for indirect, incidental, special, consequential, or punitive damages, including lost profits, lost revenue, lost data, or business interruption, even if advised of the possibility of such damages — except as to the Section 7.3 carve-outs.

8. Warranties & Disclaimers

8.1 Limited warranty. Vendor warrants that Services will be performed in a professional, workmanlike manner consistent with industry standards, that Vendor holds the rights necessary to deliver the Services, and that the Services will not knowingly infringe third-party intellectual property rights.

8.2 No security or outcome guarantee. Vendor does not warrant that any security, monitoring, backup, compliance, or advisory Service will detect, prevent, or remediate all threats, vulnerabilities, breaches, or compliance gaps; that recommendations will produce any specific business, financial, or regulatory outcome; or that Client will achieve or maintain certification/compliance with any framework (SOC 2, HIPAA, PCI-DSS, GDPR, CIS, NIST, or otherwise) solely by using the Services. This disclaimer applies to every Offering Schedule; no Offering may promise a security or compliance outcome without an explicit, separately negotiated exception.

8.3 Disclaimer of implied warranties. Except as expressly stated in 8.1, Vendor disclaims all other warranties, express, implied, or statutory, including merchantability, fitness for a particular purpose, non-infringement, and any warranty of uninterrupted or error-free operation.

8.4 Advisory nature. All recommendations, findings, risk scores, and remediation guidance are advisory. Client is solely responsible for evaluating, prioritizing, testing, and implementing (or declining to implement) any recommendation, and for its own independent verification of legal/regulatory compliance.

9. Indemnification

9.1 By Vendor. Vendor defends, indemnifies, and holds Client harmless against third-party claims that a Service, as delivered and used in accordance with the Agreement, infringes that party’s patent, copyright, trademark, or trade secret, subject to prompt notice, Vendor’s sole control of defense/settlement, and Client’s reasonable cooperation. If use becomes or is reasonably likely to become infringing, Vendor may, at its option: (a) procure continued-use rights, (b) modify or replace the Service to be non-infringing while preserving materially equivalent functionality, or (c) terminate the affected Service and refund prepaid, unused fees pro-rata.

9.2 By Client. Client defends, indemnifies, and holds Vendor harmless against third-party claims arising from:

1. Client’s breach of its Acceptable Use obligations or the Agreement;
2. Client Data or Client-provided content infringing third-party rights or violating law;
3. Client’s failure to obtain necessary authorizations, consents, or system-owner permissions before enrolling assets or authorizing monitoring/testing; and
4. Client’s unauthorized disclosure of Confidential Information.

9.3 Procedure. The indemnified party must give prompt written notice, grant the indemnifying party sole control of defense/settlement (no settlement admitting liability or imposing obligations on the indemnified party without its consent), and provide reasonable cooperation at the indemnifying party’s expense.

10. Governing Law and Venue; Notices, Amendment, Severability

10.1 Governing Law and Venue

Governing law. This Agreement is governed by the laws of the State of New York, without regard to conflict-of-laws principles.

Venue. The state and federal courts for Bronx County, New York (meaning the state courts sitting in Bronx County and the federal courts having jurisdiction over Bronx County) have exclusive jurisdiction over any dispute arising out of or relating to this Agreement, and venue lies exclusively in Bronx County, New York.

10.2 Dispute resolution. Before litigation, the parties will attempt good-faith negotiation between senior representatives (target: 15–30 days), escalating to non-binding mediation if unresolved, before either party pursues litigation or arbitration in the courts/forum of the governing-law jurisdiction. Either party may seek emergency injunctive relief without exhausting this process where irreparable harm (for example, confidentiality breach or IP infringement) is at stake.

10.3 Notices. Notices are effective on personal delivery, one business day after overnight courier, three business days after certified mail, or on email delivery/read confirmation, sent to the addresses on file in the Section-06 Order Form or Client’s billing contact.

10.4 Amendment. No amendment to the MSA, this Master Terms document, the SLA, the NDA, or any Schedule is valid unless in writing and signed (or, where a Schedule allows, confirmed by authorized-representative email) by both parties. Material changes affecting fees, scope, or liability require at least 30 days’ notice (or the longer period stated in the specific Schedule) and Client’s right to terminate without penalty if it rejects the change.

10.5 Severability. An invalid or unenforceable provision is reformed to the minimum extent necessary to be enforceable, or severed if reformation is not possible; the remainder of the Agreement continues in force.

10.6 Entire agreement. The Agreement (MSA, this Master Terms document, SLA, NDA, applicable Schedules, and Section-06 Order Form) is the entire agreement between the parties regarding its subject matter and supersedes all prior negotiations, understandings, and agreements, whether written or oral.

11. Precedence & Inheritance

How a Section-06 Engagement inherits these Master Terms and the applicable Offering Schedule(s):

1. The Section-06 Engagement / Order Form is the commercial trigger, not an independent contract. It identifies which Offering(s) and Schedule(s) are in scope for a specific Client, states the subscription tier, term, activation date, and price, and thereby activates the Master Terms and the relevant Schedule(s) as the governing terms for that engagement. It does not itself create new substantive rights or obligations beyond what the Master Terms and the named Schedule(s) already provide, except for the specific commercial variables (price, term length, tier) it is designed to carry.
2. Layered inheritance; narrowest wins only on operational detail. The Section-06 Engagement inherits, in descending order of authority:
   • the MSA (general commercial/legal framework — payment discipline, dispute resolution, assignment, general risk allocation);
   • these Master Terms (the reconciled statement of MSA-level defaults for billing, IP, confidentiality, liability caps, warranties, and precedence);
   • the SLA (availability/performance/incident-response mechanics common across all Offerings);
   • the NDA (confidentiality baseline); and
   • the applicable Offering Schedule(s) named in the Order Form (offering-specific scope, fees, and operational detail — for example, the vCISO Subscription (Professional Tier) Schedule, or a bundled combination such as vCISO + Dark Web Monitoring + Extra Portal Users).
3. A Schedule may only ADD, never SUBTRACT. Schedule clauses may add offering-specific detail (for example, a tighter SLA response time, a narrower per-asset fee, or additional data-retention specificity) but may not reduce a protection guaranteed at the Master Terms level. Specifically, a Schedule cannot:
   1. lower the Section 7.1 liability cap below what the Master Terms would otherwise apply, unless the Schedule states an alternative, mutually accepted cap that both parties have separately negotiated and signed (Section 7.2 is the one place these Master Terms expressly permit per-schedule variance, because several Schedules state deliberately different dollar caps);
   2. shorten the NDA confidentiality survival period;
   3. narrow the disclaimer in Section 8.2 (no Schedule may promise a security/compliance outcome); or
   4. omit the indemnification or data-breach-notification baseline.
4. Multiple Offering Schedules within one engagement. Where a Client’s Section-06 Engagement bundles multiple Offerings (for example, the vCISO Professional subscription plus several add-ons), each Schedule governs its own Offering’s scope and fees independently. A breach or termination of one Schedule does not automatically terminate another Schedule under the same engagement UNLESS the terminated Schedule is a prerequisite dependency for another. Add-on Schedules that terminate automatically when the base vCISO, RMM, or Jamf-managed subscription hosting them terminates (“prerequisite termination”) reflect a genuine technical/commercial dependency and are valid, non-conflicting detail rather than an improper subtraction from a Master protection.
5. Meaning of “Section-06 Engagement.” “Section-06 Engagement” means the commercial engagement / order-form layer generally (the work authorization carrying the commercial terms), not any cost or budget analysis section that happens to be numbered 6. Schedules that cite “order 6” or “order 19” resolve to this same definition.

12. Offering Schedules

The following 22 Offering Schedules are incorporated under these Master Terms. Each adds offering-specific scope, fees, service levels, data-handling, and liability detail, and none may subtract from the protections stated above.