1. Scope. Extends RMM to cloud/hybrid infrastructure: agent-based monitoring (AWS EC2/Azure VM/GCE), agentless API health checks, health/availability alerting, automated maintenance scripts/runbooks, unified on-prem+cloud dashboards, and optional cloud-specific integration modules (CloudWatch, Azure Monitor, GCP Operations, Kubernetes, cost/usage platforms). Excludes cloud provisioning/deprovisioning, incident response beyond automated runbooks, cloud-architecture strategy, application-layer remediation, and multi-tenant/MSP isolation.
2. Fees & Billing. Monthly recurring subscription per elected tier (Essentials/Professional/Enterprise/Enterprise Plus/Legacy), Net 30. No activation fee — includes up to 5 initial agent deployments, 3 custom alert policies, dashboard-template configuration. Overages (instances/API calls/scripts) billed in arrears. First invoice prorated to first calendar month-end. Non-payment: 15-day grace period (45 days total from invoice) → suspension, $50/month late fee, potential collection referral. Pricing fixed for initial 12-month term; thereafter annual adjustment up to 10%, with 60 days' notice and 30-day termination right on increase.
3. Term & Termination. 12-month Initial Term, auto-renews 12-month periods absent 60 days' non-renewal notice. Client convenience termination: within Initial Term, last day of billing month, no refund; after Initial Term, month-to-month with 30 days' notice. Either-party cause termination: 30-day cure, insolvency, or >60 days' non-payment. Post-termination: monitoring/script execution ceases within 24 hours; data retained 30 days for export; Portal access revoked; all accrued fees applied. §§4, 6, 8, 9, 10 survive termination.
4. Service Levels. 99.5% monthly uptime of monitoring infrastructure (agents/API/dashboard), scheduled maintenance excluded if announced ≥7 days in advance. Support by tier: Essentials 8–17 PT M–F, 8-hr response; Professional 7–20 PT M–F, 4-hr response; Enterprise 24/7, 2-hr response; Enterprise Plus 24/7, 1-hr response + dedicated TAM; Legacy 8–17 PT M–F, 8-hr response. Critical-issue resolution SLA: 24 hrs (>50% resources affected) / best-effort otherwise. SLA credits: 99.0–99.49% = 10%; 98.0–98.99% = 25%; <98.0% = 50% of monthly fee, claimed in writing within 30 days. Excludes Client-caused downtime, third-party outages, DoS/malware (except Vendor security failures), announced maintenance, force majeure.
5. Client Responsibilities. Maintain valid cloud credentials, ensure instance accessibility, designate operational contact, notify Vendor of planned infrastructure changes, review alert rules/script plans quarterly. Prohibited: monitoring third parties without consent, reverse-engineering/bypassing security, attacking Vendor/other-customer environments, illegal use, exceeding tier limits for >30 days without upgrade. Cloud API credentials/SSH keys/service-account tokens: encrypted vault (AES-256), annual rotation or upon compromise, minimum required permissions, immediate replacement + 24-hr notification on compromise.
6. Data Handling. Collects monitoring telemetry (CPU/memory/disk/network/failed processes/patch status), configuration data (metadata/tags/region/packages/firewall rules), alert audit trail, and configurable application/system/agent-debug logs. Telemetry/config retained 12 months then archived to S3 Glacier, deleted after 7 years; logs/audit trail retained 90 days then deleted (extendable at $0.50/GB-month). Post-termination: active data exported within 5 business days; archived data deleted unless extended access purchased ($100/month per retention year). Security: TLS 1.2+, mutual cert pinning agent-to-backend, AES-256-GCM at rest, per-customer KMS keys, RBAC, SAML/OAuth, 12-month immutable audit logs. Breach notification: 24 hours. SOC 2 Type II pending (Q4 2026), HIPAA BAA upon execution, GDPR DPA/SCCs included. Subprocessors: AWS (US-East-1 default telemetry/agent delivery), SendGrid (email), Twilio (SMS), PagerDuty (optional). Confidentiality survives 3 years post-term.
7. Third-Party Components. Depends on AWS/Azure/GCP/SendGrid/Twilio/Kubernetes (optional) — Client's use = acceptance of their ToS. OSS components (Node.js/MIT, Python/PSF/Apache 2.0, Prometheus client/Apache 2.0); SBOM published at https://docs.3vs.io/cloud-rmm/sbom. Security patches: 30 days standard, 7 days critical, staged rollback testing. Client responsible for OS patching and re-authorizing rotated service-account credentials. Critical-dependency unavailability: alternative delivery within 15 days or penalty-free termination right.
8. Warranties. Limited warranty: material functional conformance, agent/dashboard free from malware/backdoors/intentional vulnerability to extent of reasonable Vendor security testing, personnel hold current security certs and undergo annual background checks. AS-IS delivery — provided scripts are templates, Client must test in staging before production use. Explicit no-guarantee of incident prevention/detection completeness, script-remediation success, or alert-delivery timing if channels unavailable. No legal/compliance advice provided; Client bears independent compliance interpretation and control-implementation responsibility.
9. Liability & Indemnification. Liability cap: total fees paid in trailing 12 months (Master §7.1 default formula, no Schedule-specific floor). Excluded damages per Master §7.4. Client indemnifies for Schedule violations/illegal use, Client's cloud infrastructure/data/configurations, monitoring-data misuse by Client personnel, third-party-tool integration issues (excluded where Vendor gross negligence/willful misconduct/material breach is the cause). Vendor indemnifies IP-infringement claims for the Service used per this Schedule (excludes unauthorized modification, non-Vendor combination, or unauthorized use).
10. Precedence. (1) This Schedule > (2) MSA > (3) incorporated SLA > (4) NDA > (5) SOWs > (6) WHMCS Order Confirmation for Cloud-RMM-specific matters (patching, subprocessors, telemetry weights) only; MSA controls general matters (payment, term, dispute resolution) not addressed here, per Master §2's reconciliation of Schedule-specific override to genuinely offering-specific operational detail. Governing law and venue: New York law; exclusive venue in the state and federal courts for Bronx County, New York, consistent with Master §10.1. Amendments require written signature; no oral modifications binding.
