1. Scope. Continuous automated dark-web/forum/marketplace surveillance for credential leaks, data-breach presence, brand mentions, and threat-intel correlation, delivered via 24/7 monitoring, real-time alerts, dashboard, and monthly intelligence report. Excludes manual incident response, data removal, internal-network monitoring, insider-threat notification, regulatory filings, and law-enforcement coordination. Add-on to base Packages 38/39; base termination auto-suspends this Service.
2. Fees & Billing. Recurring monthly/annual, tied to base package billing cycle; mid-cycle activation prorated. Payment terms and late-payment interest per Master §3.1–3.2. Offering-specific suspension trigger: 15 days past due (tighter than Master §3.3 default), per Master §3.3's carve-out for Schedule-specific numbers. Price increases per Master §3.5 (60 days' notice); >10% increase gives Client 30 days to cancel. Non-refundable except per §3 termination remedies below.
3. Term & Termination. 12-month initial term, auto-renews annually (30 days' non-renewal notice). Client termination for convenience: 30 days' notice, effective end of billing month, no refund. Client termination for Vendor breach: 15-business-day cure, then immediate termination + pro-rata refund. SLA-failure termination: 2+ consecutive months of missed Alert SLA/availability → 25% credit or pro-rata refund (Client election). Vendor termination for non-payment: 45 days + 15 days' notice. Base-package termination auto-terminates this Schedule. Post-termination: monitoring ceases within 24 hours; findings accessible read-only 30 days, then deleted; export available on request within that window.
4. Service Levels. 99.5% platform uptime, measured monthly, excluding scheduled maintenance (Sundays 00:00–04:00 UTC, 72 hrs' notice for windows >2 hrs). Alert SLA: 4 business hours standard, 2 hours for high-privilege-account findings. Support: Critical 1 hr / High 4 hrs / Medium 8 business hrs / Low 2 business days. SLA remedy: 5% monthly credit for 2+ missed-SLA incidents in a month (sole remedy; does not waive §3 termination rights). Vendor's SLA does not extend to third-party dark-web data-source availability/accuracy (see §7).
5. Client Responsibilities. Maintain current alert-recipient contacts; authorize a responsible party; cooperate in alert-delivery testing; supply brand/domain identifiers to monitor. Acceptable use prohibits: monitoring parties Client lacks authority over, reverse-engineering, illegal surveillance/espionage use, credential/API-key sharing, resale of findings, harassment use. Responsible-disclosure protocol required if third-party data is co-exposed (consult Vendor before contact). Client must report confirmed breaches within 24 hours and may opt out of anonymized data use for model improvement.
6. Data Handling. Client Data = monitored identifiers, findings, access/alert logs. Findings retained 24 months; alert/notification logs 12 months; dashboard access logs 90 days; all deleted within 60 days post-termination absent extended-archival purchase. Confidentiality per Master §5, plus: findings not shared with law enforcement/other clients without consent (subject to legal process). Encryption in transit (TLS 1.2+) and at rest (AES-256); SOC 2 Type II audit pending (target Q4 2026). Regulatory: Client is data controller for GDPR/CCPA purposes; Vendor is processor under incorporated DPA. Breach notification: 30 days (looser than Master §6.3's 72-hour default — flagged; Master Terms should control per precedence unless this represents an intentional narrower commitment for this Offering's specific breach-detection scope). Subprocessor list available; 30-day objection window, unresolved objection = termination right.
7. Third-Party Components. Proprietary crawling tech + licensed third-party dark-web intelligence feeds + public breach archives. No warranty of complete coverage; 1–7 day feed latency typical; source takedown/closure is expected and outside Vendor control. Vendor maintains redundant sources and cross-validation but assumes no continuity obligation for any single source. Governed by incorporated DPA for third-party data-handling practices.
8. Warranties. Limited warranty: professional performance, non-infringing IP, dashboard/alerting functions as documented. Disclaims completeness of detection, accuracy of findings (false positives possible), specific delivery timing (only SLA-window compliance), breach prevention, and third-party data accuracy/continuity — consistent with Master §8.2 (no security-outcome guarantee), stated here with offering-specific detail on dark-web coverage limits. Service is a detective, not preventive, control; Client must layer additional controls. No compliance-outcome warranty (Master §8.2).
9. Liability & Indemnification. Liability cap: lesser of (fees paid in trailing 12 months) or $50,000 (Schedule-specific dollar floor per Master §7.2). Consequential damages excluded per Master §7.4. Carve-outs per Master §7.3. Vendor indemnifies against IP-infringement claims from findings/Service delivery (excludes Client modification/misuse). Client indemnifies for Acceptable Use violations, non-compliance with data-protection/breach-notification law, unauthorized disclosure of findings, and illegal-activity use. Sole remedy for Service defect: termination + pro-rata refund per §3, absent a greater legal remedy.
10. Precedence. Governed by Master Terms §2 (MSA > Master Terms > SLA > NDA > this Schedule > Order Form > general ToS). Amendment: 30 days' notice; subprocessor/DPA updates 30 days with objection right; pricing changes per §2.4. Effective on Service activation.
