Master Service Agreement

“Software” means the RoboSystems platform software published by RoboSystems under the Apache License 2.0, together with any updates RoboSystems publishes.

“Platform” means the Software as deployed and operated — whether as hosted services operated by RoboSystems under Customer’s separate agreement with RoboSystems (the “Platform Agreement”), or by Customer in infrastructure Customer controls.

“Customer Environment” means all infrastructure, accounts, systems, and data owned or controlled by Customer, including Customer’s cloud provider accounts and any environment in which Customer operates the Software.

“Services” means the professional services described in Section 2 and in any statement of work executed under this Agreement (each an “SOW”).

“Deliverables” means work product created by Provider specifically for Customer under an SOW, such as a Customer-specific integration.

“Customer Materials” means information Customer voluntarily discloses to Provider in the course of the Services, including logs, configuration excerpts, error output, schemas, and screen-shared views.

2.1 Provider will provide the Services stated in each SOW, which may include: (a) forward-deployed engineering — Provider personnel working alongside Customer’s team to integrate, configure, and extend the Platform for Customer’s use; (b) development of integrations, adapters, and extensions; (c) advisory and architectural guidance on deploying, configuring, operating, and upgrading the Software; (d) support in diagnosing issues Customer reports; (e) training and enablement; and (f) guidance on Customer’s own compliance readiness relating to its operation of the Software.

2.2 Delivery method. Services are delivered remotely through written guidance, documentation, scheduled consultation, asynchronous support channels, code delivered to repositories Customer controls, work performed through the Platform’s published interfaces per Section 4.4, and screen-sharing sessions conducted and controlled by Customer. Within the Customer Environment, Provider advises and Customer operates.

2.3 What Provider does not undertake. Provider does not operate the Platform and does not operate, administer, monitor, patch, back up, secure, or assume availability responsibility for the Customer Environment, and does not perform incident response within it. Hosted platform services, where Customer uses them, are provided by RoboSystems under the Platform Agreement, not by Provider under this Agreement. Where Customer self-hosts, responsibility for the deployment rests solely with Customer.

2.4 Support parameters. Support channels, coverage hours, and target response times, where applicable, are stated in the SOW. Provider commits to response targets only — never to resolution times or availability levels, since Provider cannot act in the environments where issues occur.

2.5 Each SOW incorporates this Agreement. In case of conflict, the SOW governs for that engagement, except that no SOW may modify Section 4 (Access Boundary) or Section 5 (Attestation Scope) other than by explicit reference to the section being modified.

Customer is solely responsible for: (a) obtaining, deploying, configuring, and operating the Software where Customer self-hosts, and maintaining its Platform Agreement in good standing where it uses hosted services; (b) all security, access control, encryption, monitoring, logging, backup, disaster recovery, and incident response for the Customer Environment; (c) all agreements with, and payments to, Customer’s own cloud and third-party providers; (d) the accuracy, lawfulness, and protection of all data in the Customer Environment, including any personal or financial data of Customer’s own clients; (e) any regulatory or contractual compliance obligations arising from Customer’s operation of the Software; (f) applying updates, including security updates, to any deployment Customer operates; and (g) issuing, scoping, and managing the platform credentials contemplated by Section 4.4, and timely provision of the access, personnel, and decisions the SOW identifies as Customer dependencies.

4.1 Provider will not access the Customer Environment. Provider will not request, accept, hold, or use credentials to the Customer Environment; will not assume any role, establish any federated or cross-account access, or hold any key, token, or certificate granting access to it; and will not connect to, operate within, or execute commands against it.

4.2 The covenant survives Customer’s offer. If Customer offers Provider access to the Customer Environment, Provider will decline, and Customer’s offer does not waive, modify, or excuse this Section. Any grant of access made notwithstanding this Section is ineffective as consent, and Provider will not exercise it.

4.3 Provider does not hold Customer’s data by virtue of the Services. Except as expressly provided in Section 4.4, Provider will not receive, store, process, or transmit data held in the Customer Environment or in the Platform.

4.4 Work performed through the Platform’s published interfaces. Notwithstanding Section 4.1, where the Services include forward-deployed engineering or building, operating, or supporting integrations, that work is performed exclusively through the Platform’s published application programming interfaces and user-facing applications, authenticated by API credentials or user accounts that Customer issues, scopes to the specific graphs and data required, and may revoke at any time and without notice. Such credentials are not access to the Customer Environment, and Section 4.1 continues to apply in full to the infrastructure, accounts, and systems Customer controls.

(a) Customer-operated integrations. Where Provider delivers an integration that Customer deploys and operates, Provider does not process Customer data through it and is not a processor with respect to that data.

(b) Provider-operated integrations. Where Customer engages Provider to operate an integration on Provider’s or its affiliate’s infrastructure, Provider processes Customer data to that extent and acts as Customer’s processor; the parties will execute a Data Processing Addendum covering that processing.

(c) Customer control is continuous. Customer determines the scope and duration of the access described in this Section 4.4 at all times and may revoke it unilaterally. Revocation is not a breach of this Agreement, though it may prevent Provider from performing affected Services.

4.5 Customer Materials. Customer may voluntarily disclose Customer Materials to Provider in the course of the Services. Customer is responsible for redacting or withholding personal, financial, or confidential data before disclosure, and will not transmit production data containing personal information through support channels. Provider will treat Customer Materials as Customer’s Confidential Information under Section 7, use them solely to perform the Services, and delete or return them on request. Nothing in this Section obliges Provider to accept Customer Materials, and Provider may decline or require redaction.

4.6 Screen sharing. Where Services are delivered by screen share, Customer controls the session and the display. Provider will not record sessions without Customer’s prior written consent. Observation during a Customer-controlled session is not access for purposes of Section 4.1.

4.7 Changing the model. If Customer wishes an environment to be operated for it rather than by it, that arrangement is available from RoboSystems under its hosted-services terms, not from Provider under this Agreement, and this Agreement cannot be amended by course of conduct to permit it. For the avoidance of doubt, expanding the scope of work under Section 4.4 does not require such an arrangement and does not alter Section 4.1.

5.1 Separate agreements, separate obligations. Customer’s rights to hosted platform services run from RoboSystems under the Platform Agreement; Customer’s rights to use, reproduce, modify, and distribute the Software run from the Apache License 2.0. This Agreement grants neither, and nothing in this Agreement modifies either. Provider is not responsible for the Platform’s availability, security, or performance, and RoboSystems is not responsible for the Services.

5.2 Attestation scope. RoboSystems has engaged an independent CPA firm to perform a SOC 2 Type II examination covering the environments RoboSystems operates. The Services under this Agreement, the Deliverables, and the Customer Environment are outside the scope of that examination and are not covered by it. A customer holding both this Agreement and a Platform Agreement should not assume one compliance posture covers both: RoboSystems’ report speaks to the platform environments it operates, and to nothing sold under this Agreement. Customer will not state or imply, to its auditors, regulators, customers, or the public, that Provider’s Services or Deliverables, or any environment Customer operates, are covered by, certified under, or inherit that examination, and will correct any such statement promptly on becoming aware of it.

5.3 What Customer may rely on. Customer may rely on RoboSystems’ report, once issued, under the Platform Agreement’s terms, as to the platform environments RoboSystems operates and as to RoboSystems’ software development lifecycle — how the Software was developed and released. Where Customer self-hosts, Customer may state that its deployment implements control designs published in the Software and its infrastructure-as-code; Customer may not state that anyone’s controls operate in the Customer Environment other than its own.

5.4 The Software is not warranted under this Agreement. The Software is provided by RoboSystems under the Apache License 2.0 without warranty and without support. Provider’s obligations under this Agreement run to the Services, not to the Software, and Provider does not warrant the Software, its fitness for Customer’s purpose, or its suitability for any regulatory requirement. Provider has no obligation to cause RoboSystems to maintain, update, or continue publishing the Software; where Customer requires a change to the Software, Provider may propose it as an upstream contribution to the public repository, which RoboSystems may accept or decline.

5.5 Security notifications. Security vulnerabilities in the Software and security-related releases are announced by RoboSystems through its published channels. Provider will pass material advisories to the notice contacts in the SOW where the SOW so provides, but has no ability to apply them to environments it does not access; doing so is Customer’s responsibility under Section 3(f).

6.1 Provider retains all right, title, and interest in its methodologies, know-how, tools, templates, and any pre-existing or generally applicable materials used in the Services. Rights in the Software itself are governed by Section 5.1, not this Section 6.

6.2 Upon full payment of the fees for the applicable SOW, Provider assigns to Customer all right, title, and interest in the Deliverables, excluding Provider’s pre-existing and generally applicable materials, which Provider licenses to Customer on a perpetual, non-exclusive, royalty-free basis for use with the Deliverables.

6.3 Provider may reuse general knowledge, skills, and experience gained in performing the Services, and may contribute improvements of general applicability to the public Software repository, provided it discloses no Customer Confidential Information.

6.4 Deliverables that integrate with the Platform are developed to run outside the Platform — in repositories and infrastructure Customer controls, or Provider’s where Section 4.4(b) applies — and interact with the Platform exclusively through its published interfaces.

Each party will protect the other’s Confidential Information with no less than reasonable care, use it only to perform under this Agreement, and not disclose it except to personnel and advisors bound by confidentiality obligations at least as protective, or as required by law with prompt notice where lawful. Confidential Information excludes information that is public without breach, independently developed, rightfully received from a third party, or already known. These obligations survive termination for five (5) years, and indefinitely for trade secrets. Customer Materials are Customer’s Confidential Information.

Customer will pay the fees stated in each SOW. Unless the SOW states otherwise, time-and-materials fees are invoiced monthly in arrears, fixed fees are invoiced per the SOW’s milestone schedule, and recurring support fees are invoiced monthly in advance. Amounts are due within thirty (30) days of invoice and are non-refundable except as expressly provided. Pre-approved, reasonable out-of-pocket expenses are reimbursable at cost. Late amounts may accrue interest at the lesser of 1.5% per month or the maximum lawful rate. Fees exclude taxes other than Provider’s income taxes, and exclude Customer’s own cloud, platform-subscription, and third-party costs, which Customer pays directly to its providers.

This Agreement runs from the Effective Date until terminated. Either party may terminate this Agreement or an SOW for convenience on thirty (30) days’ written notice, or for material breach uncured within thirty (30) days of written notice. Termination of this Agreement terminates all SOWs unless the parties agree an SOW will run to completion under this Agreement’s terms. Termination does not affect Customer’s rights in the Software under the Apache License 2.0 or under the Platform Agreement, which continue independently. On termination, Provider will deliver work in progress that has been paid for, return or delete Customer Materials, and Customer will pay for Services performed through the termination date. Sections 4.3, 4.4, 5, 6, 7, and 10 through 14 survive.

Each party warrants it has authority to enter this Agreement. Provider warrants that the Services will be performed in a professional and workmanlike manner by personnel with appropriate skill, and will re-perform non-conforming Services reported within thirty (30) days of performance. EXCEPT AS EXPRESSLY STATED, THE SERVICES AND DELIVERABLES ARE PROVIDED “AS IS” AND PROVIDER DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. PROVIDER MAKES NO WARRANTY AS TO THE SOFTWARE, THE PLATFORM, OR THE AVAILABILITY, SECURITY, PERFORMANCE, OR COMPLIANCE OF THE CUSTOMER ENVIRONMENT, WHICH PROVIDER DOES NOT OPERATE AND CANNOT OBSERVE. THE SERVICES DO NOT CONSTITUTE ACCOUNTING, TAX, LEGAL, OR INVESTMENT ADVICE; PROFESSIONAL JUDGMENT REMAINS THE RESPONSIBILITY OF CUSTOMER AND ITS ADVISORS.

Provider will defend Customer against third-party claims that a Deliverable, as delivered and used as intended, infringes a U.S. patent, copyright, or trademark, and will pay resulting damages finally awarded, provided Customer gives prompt notice, control of the defense, and reasonable cooperation; Provider may modify or replace the Deliverable, or refund the fees paid for it and terminate the affected SOW, if infringement is claimed. This obligation does not extend to the Software, to combinations with materials Provider did not supply, or to modifications made by anyone other than Provider. Customer will defend Provider against third-party claims arising from Customer’s data, Customer Materials, or Customer’s use of the Services or Deliverables in violation of this Agreement or law, on the same conditions.

EXCEPT FOR BREACH OF SECTION 4 OR SECTION 7, INDEMNIFICATION OBLIGATIONS, OR A PARTY’S WILLFUL MISCONDUCT: (A) NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR LOST PROFITS, REVENUE, OR DATA; AND (B) EACH PARTY’S AGGREGATE LIABILITY UNDER THIS AGREEMENT IS CAPPED AT THE FEES PAID OR PAYABLE BY CUSTOMER UNDER THE APPLICABLE SOW IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY. FOR THE AVOIDANCE OF DOUBT, PROVIDER HAS NO LIABILITY FOR THE PLATFORM, WHICH IT DOES NOT OPERATE, OR FOR LOSS, CORRUPTION, OR DISCLOSURE OF DATA IN THE CUSTOMER ENVIRONMENT, WHICH IT DOES NOT ACCESS OR CONTROL.

During the term of this Agreement and for twelve (12) months after its termination, neither party will solicit for employment or engagement any personnel of the other who performed or received the Services, except through general advertisements not targeted at such personnel and hires resulting from them.

Neither party may assign this Agreement without the other’s consent, except to a successor in a merger, reorganization, or sale of substantially all assets. Provider may perform through affiliates or subcontractors bound to obligations at least as protective as Sections 4 and 7, and remains responsible for their performance. The parties are independent contractors. Notices must be in writing to the addresses stated in the SOW. Neither party is liable for delay caused by events beyond its reasonable control. Neither party will use the other’s name or marks in publicity without prior written consent, except that Provider may identify Customer in a customer list following Customer’s written approval. This Agreement is governed by the laws of the State of Wyoming, excluding conflict-of-law rules; exclusive venue lies in the state or federal courts located in Laramie County, Wyoming. Statements of Work incorporating this Agreement may be executed in counterparts, including by electronic signature, each of which is deemed an original. This Agreement, with its SOWs, is the entire agreement as to its subject matter and supersedes prior discussions; amendments must be in writing signed by both parties.

Questions about this Agreement? Email hello@harbinger.finance.