1. Scope. Increases Client's portal-user entitlement by 25 concurrent authenticated identities (WHMCS Addon ID 7; Packages 40/41), each receiving authentication credentials, role-based access consistent with subscription tier, audit logging, and directory-integration support (AD/Okta/Google Workspace where configured). Excludes custom role definitions, dedicated onboarding/training, and feature/API-quota expansion. Requires active vCISO subscription (Professional tier or above); base termination auto-suspends this Addon.
2. Fees & Billing. Recurring fee per monthly or annual billing election (annual = 12× monthly, less any tier discount per vCISO Subscription Agreement §19). Invoiced each renewal date, Net 30. Late payment (15+ days): new-user provisioning suspension, reverse-order access revocation for newly added users, 1.5%/month late fee. Non-refundable once ordered; no proration for mid-term termination.
3. Term & Termination. Term matches underlying vCISO subscription term (typically 12 months from Activation Date), auto-renews on the subscription's cycle absent 30-day non-renewal notice; renewal conditioned on subscription remaining in good standing. Client convenience termination: 30 days' notice; new provisioning ceases at 30 days, existing accounts remain through billing-cycle end, full deprovisioning by first business day thereafter. Vendor suspension for uncured 15-day breach, 30-day non-payment, or AUP violation. Base subscription termination auto-terminates this Addon.
4. Service Levels. Same availability target as incorporated 3VS SLA (99.5% monthly uptime, excluding scheduled maintenance). Support included in vCISO tier: Standard (email, M–F 8 AM–6 PM CT, 24-business-hr response) or Premium (24/7, 4-hr P1 response). User-provisioning/auth/access incidents default P2, escalate to P1 if all 25 new users are blocked and business-critical. SLA credit for 2+ consecutive months' shortfall (sole remedy, doesn't waive payment obligation). Excludes user training, role/workflow customization, dedicated TAM.
5. Client Responsibilities. Lawful, authorized business use only; no credential sharing/resale/unauthorized distribution; no reverse-engineering or authentication circumvention. Prompt (24-hr) unauthorized-access notification; deprovision departed users within 10 business days; unique credentials per user, no reuse. Acknowledges platform rate-limiting/session-concurrency protections are not Availability-SLA breaches when traffic exceeds documented thresholds. Compliance with export control, data-protection, and anti-money-laundering law.
6. Data Handling. Collects user name, email, organizational affiliation, role/permission metadata, login timestamps/IP, access logs. Processed under incorporated DPA/NDA; retained minimum 12 months for audit purposes; not used for marketing/profiling/resale without written consent. Confidentiality: user provisioning data is Confidential Information under NDA. Subprocessor list available; equivalent-protection standard applies to additions. Breach notification: 72 hours (matches Master §6.3 default); sole remedy for breach is §3 suspension/termination rights, not monetary damages beyond §9 cap.
7. Third-Party Components. Portal infrastructure may use third-party IAM (Okta/Azure AD/Auth0), cloud hosting (AWS/GCP/Azure), and observability tooling (Datadog/New Relic/Splunk). SSO integration: Client responsible for accurate SAML/OAuth/OIDC configuration and its own IdP's availability/directory lifecycle; Vendor not responsible for Client's SSO-provider outages. Third-party component replacement/upgrade: 30 days' notice; functionally equivalent replacement is not a material breach.
8. Warranties. Limited warranty: material functional conformance (seat provisioning, RBAC, audit logging) and applicable-law compliance. Disclaims merchantability/fitness/non-infringement, uninterrupted/error-free operation, content accuracy, and seamless integration with non-catalog third-party systems, per Master §8.3. AS-IS delivery; no specific defect-correction-timeframe warranty beyond SLA support tiers. Beta/experimental features excluded from warranty and SLA entirely.
9. Liability & Indemnification. Liability cap: total fees paid for this Addon in trailing 12 months (Master §7.1 default formula, no Schedule-specific floor; illustrative example given: $1,200 paid → $1,200 cap). Excluded-damages list per Master §7.4. Carve-outs (confidentiality, IP infringement, indemnification obligations) uncapped per Master §7.3. Client indemnifies for AUP violations, compromised-credential incidents from Client's own failure to protect them, Client-input content/systems, and employee/end-user claims. Vendor indemnifies IP-infringement claims for the unmodified, properly configured portal, with standard cure options.
10. Precedence. MSA (highest) > NDA > incorporated SLA > vCISO Subscription Agreement (section 19, strategic business review per source) > this Schedule > general Vantage ToS/AUP (lowest). Amendment: 30 days' notice for material changes (fee increases, SLA downgrades, scope narrowing), with 15-day objection/termination-without-penalty window; minor changes require no notice. Sections 6, 8, 9, and 10 survive termination.
