1. Scope. Endpoint monitoring agent (Windows/macOS/Linux), real-time system-health/metric collection, automated threshold-based alerting, web dashboards/reporting, agent lifecycle management, and Integration Hub (API/webhooks for ITSM/SIEM/ticketing). Excludes remediation execution, custom monitoring-rule/agent modification beyond documented parameters, physical device access/hardware repair, and end-user endpoint support for unenrolled devices.
2. Fees & Billing. Per-monitored-device recurring basis (monthly/annual per Order Form); device count measured at cycle end via active agent registrations, with true-up billing for increases in arrears and decreases per MSA credit/refund mechanics. Invoices within 5 business days of cycle end, Net 30 (or per Order Form), via WHMCS/email. Optional add-ons (extended retention, custom dashboards, API rate-limit increases, third-party integration setup) require written order and take effect next cycle. Taxes exclusive, borne by Client absent exemption certificate.
3. Term & Termination. 12-month Initial Term from Service Start Date, auto-renews 12-month periods absent 30-day non-renewal notice; renewal fees may be adjusted with 30 days' notice, Client termination right without penalty if not accepted. Mutual termination at any time by written agreement. Client convenience termination: 30 days' notice, no penalty (absent payment default). Vendor convenience termination: 60 days' notice, not before then-current billing period ends absent §3.3 cause. Cause termination (Vendor-initiated): 15-business-day uncured breach, AUP/law violation, or infrastructure-disruptive use. Post-termination: 10-calendar-day transition window for data export and agent uninstallation, then deletion/deactivation; one-time raw-data export (JSON/CSV) available during that window. No refund for Client-convenience termination; pro-rata refund for Vendor-cause termination less unpaid fees/damages.
4. Service Levels. 99.5% monthly platform uptime target (dashboard/API/agent-communication endpoints), per incorporated 3VS SLA — excludes Client-side network/connectivity/endpoint-outage causes, scheduled maintenance, and force majeure. Agent polling: every 5–15 minutes (default 5 min), configurable. Critical alert latency: within 2 minutes; non-critical alerts may batch, delivered within 15 minutes. Dashboard data freshness: within last 15 minutes, no real-time guarantee. Support: email/ticket M–F 8 AM–5 PM UTC excluding holidays — Critical 2 hrs, High 8 hrs, Medium 24 hrs, Low 48 hrs (targets, not guarantees). After-hours 24/7/365 coverage available as premium add-on. Standard data retention: 30 days raw, 12 months aggregated daily summaries; extended retention (up to 7 years) available as add-on; all data permanently deleted 10 days post-termination absent export.
5. Client Responsibilities. Identify/approve assets for enrollment, maintain accurate asset inventory, notify Vendor of enrollment-scope changes, confirm ownership/authorization for all monitored systems. Ensure persistent unfiltered connectivity to Vendor infrastructure (documented IP ranges/hostnames, HTTPS/443, UDP/5353); provision adequate bandwidth (typical overhead 50–500 KB/endpoint/day); troubleshoot connectivity within 48 hours of discovery. Install agents via provided deployment methods, grant local admin privileges for collection, allow automatic monthly updates (max 30-day per-endpoint delay), avoid tampering with agent binaries/config. Data-access/confidentiality: limit dashboard access, use strong/MFA-protected credentials, no unauthorized export/sharing, prompt breach notification. Prohibited: monitoring unauthorized/unowned endpoints, reverse-engineering, attacks against the platform, competing-product development, malicious alert/report configuration. Compliance responsibility: Client ensures RMM deployment complies with applicable law/regulation/internal policy/employee-disclosure requirements.
6. Data Handling. Client retains data ownership; Vendor is processor. Confidentiality: no third-party disclosure except cloud subprocessors (AWS/Azure/GCP, third-party analytics — current list on request, 30-day material-change notice). Encryption: TLS 1.2+ in transit, AES-256 at rest, per-Client data isolation, logged/audited support-purpose access. SOC 2 Type II audit pending (target Q4 2026); annual third-party audit thereafter, available under NDA. Breach notification: 72 hours, detailing nature/affected-data/remediation. GDPR/CCPA: Client is Controller, Vendor is Processor per incorporated DPA — Vendor processes only per Client instruction, no out-of-jurisdiction transfer absent consent/appropriate safeguards; Client bears privacy-notice/data-subject-rights responsibility. Deletion: Client-initiated deletion within 10 business days; termination export window 10 days, then permanent deletion. Audit logs (logins, config changes, access events) retained 12 months, not Client-deletable absent legal requirement. Confidentiality survives 5 years post-termination.
7. Third-Party Components. Includes OSS libraries under MIT/Apache 2.0/GPL and others — BOM available; Client acceptance of RMM implies OSS-license acceptance, no additional rights granted beyond the OSS licenses themselves. Optional third-party integrations (Jira/ServiceNow/Zendesk/Freshservice, Slack/Teams, Datadog/New Relic/Splunk, Veeam/Commvault/BackBlaze) are Client's configuration/maintenance responsibility; Vendor provides documentation and best-effort (24-hr) connection troubleshooting only, no liability for third-party API changes/deprecation/unavailability. Agent OS-support minimums: Windows 7 SP1+/.NET 4.6.2+; macOS 10.12+; Linux kernel 3.10+/glibc 2.17+ (CentOS 7+/Ubuntu 16.04+/Debian 9+) — unsupported OS versions not covered.
8. Warranties. Limited warranty (12-month period, renewed each term): material functional conformance to documentation, agent install/operation as documented (subject to §7 system-requirement compliance), §4 availability-target compliance. Disclaims all other warranties per Master §8.3, including uninterrupted/error-free/secure operation and data 100%-accuracy/completeness/timeliness. Beta/experimental features: AS-IS, subject to change/removal without notice, not for production use without Client risk-acceptance, excluded from SLA. Warranty remedy: repair/re-perform or refund of affected billing-cycle fees (Vendor's election), 30-day claim window, 30-day cure period — no waiver from non-enforcement.
9. Liability & Indemnification. Consequential-damages exclusion per Master §7.4, explicitly covering data-loss/corruption/inaccessibility and third-party claims. Carve-outs (indemnification, confidentiality, IP infringement, gross negligence/willful misconduct, non-limitable-by-law liabilities) per Master §7.3. Cap: fees paid for RMM in trailing 12 months (or first billing cycle's fees if newly activated) — Master §7.1 default formula, no Schedule-specific dollar floor. Vendor indemnifies IP-infringement claims regarding the RMM agent/platform as provided, with standard notice/control/cooperation procedure and cure options (continued-use rights, non-infringing modification, or termination + pro-rated refund). Client indemnifies for unauthorized/improper use (unauthorized monitoring, AUP violation), law violations, third-party-system integration/combination claims, and employee/customer claims regarding Client's use of monitoring data. Each party maintains $2,000,000 minimum general liability/E&O insurance, certificates available on request.
10. Precedence. (1) Amendment/Purchase Order/SOW signed by both parties > (2) this Schedule > (3) MSA (general commercial terms, payment, liability, indemnification) > (4) incorporated 3VS SLA (availability commitments, credits, remedies) > (5) NDA (confidentiality) > (6) RMM Product Documentation > (7) WHMCS ToS (account/billing access). Places this Schedule above the MSA for RMM-specific matters, but below the MSA for topics this Schedule does not address (dispute resolution, governing law) — flagged as inconsistent with Master §2's straightforward default ordering, though functionally similar to how other Schedules (e.g., Backup & DR) apply Schedule-specific override only for genuinely Schedule-specific operational numbers per Master §2's own reconciliation principle; treated as compliant on that reading. Anchored in the Vantage engagement's Section 06: Resource Allocation & OpEx, consistent with the "order 6" citation group flagged in Master Reviewer Flag #6. Amendment: 30 days' written notice (30-day objection/termination right for material modifications), effective only for renewal terms/new cycles, not retroactive to the current cycle.
