Master Services Agreement

Parties, structure and scope

1. Parties. This Master Services Agreement (“Agreement”) is between Support Bay, LLC, a California limited liability company doing business as SupportMax (“SupportMax”), and the client named in the Service Order (“Client”). SupportMax is a trade name of Support Bay, LLC and not a separate legal entity. Every right, obligation and reference to “SupportMax” in this Agreement, its schedules and any Service Order belongs to Support Bay, LLC. Invoices, Service Orders and signature blocks will name “Support Bay, LLC d/b/a SupportMax.”

2. Structure and order of precedence. This Agreement is evergreen and governs every Service Order. Each Service Order lists the services, fees, covered users and devices, and term. If documents conflict, this order controls: (a) a signed Service Order, for its pricing and scope only; (b) this Agreement; (c) the Service Level Agreement schedules; (d) any proposal or quote.

3. Definitions.

• Managed Services: recurring services listed in a Service Order, such as help desk, monitoring, patching, backup and security.
• Covered Environment: the users, devices, software and cloud tenants listed in the Service Order and enrolled in SupportMax’s tools.
• Third-Party Products: software, hardware, cloud services and vendors not owned by SupportMax, including Microsoft 365, backup platforms, security tools and line-of-business applications.
• Security Incident: an actual or reasonably suspected unauthorized access to, or loss of, Client systems or data.
• Out-of-Scope Work: anything not listed in a Service Order, billed at the rates in the Service Order.

4.1 Included services. SupportMax will provide only the services listed in the Service Order, at the service levels in Schedule A (Managed IT) and Schedule B (Managed Security). Anything not listed is excluded.

4.2 Standard exclusions. Unless a Service Order says otherwise, Managed Services exclude: projects and migrations; new hardware or software; on-site work outside the coverage area; devices not enrolled in SupportMax’s tools; personal devices; unsupported or end-of-life systems; recovery from Client’s own unauthorized changes; and forensic, legal or regulatory work after a Security Incident.

4.3 Client responsibilities and Declined Recommendations are set out in Sections 4.5 to 4.7 below.

4.4 Changes. Either party may request scope changes. A change takes effect only through a signed change order or updated Service Order. SupportMax may adjust monthly fees when the number of covered users or devices changes, based on the monthly count in its tools.

Client responsibilities and declined recommendations

4.5 Client responsibilities. Client will:

1. Name a primary contact with authority to approve changes and accept risk.
2. Give SupportMax timely administrative access to the Covered Environment.
3. Keep hardware and software under vendor support and properly licensed.
4. Enforce SupportMax’s security baseline on its staff, including MFA, password rules and security awareness training.
5. Report problems through SupportMax’s ticketing channels, not by personal text or social media.
6. Not install, remove or change security tools, backups or network devices without telling SupportMax first.
7. Tell SupportMax in writing before collecting any regulated data (see Section 6).

SupportMax is not responsible for any failure or delay caused by Client not meeting these duties.

4.6 Security baseline. SupportMax will provide a written security baseline for Client, reviewed at least annually. It will list the minimum controls SupportMax recommends, such as MFA everywhere, endpoint detection and response on every device, email filtering, immutable offsite backup, patching, and security awareness training.

4.7 Declined Recommendations. SupportMax will make security, backup, hardware and compliance recommendations in writing (email, ticket or quarterly business review). If Client does not approve and fund a recommendation within 30 days, or says no, it is a “Declined Recommendation.” For each Declined Recommendation:

1. Client accepts all risk that the recommendation was meant to reduce.
2. SupportMax has no liability for any loss, Security Incident, downtime or regulatory penalty that the recommendation would reasonably have prevented or reduced.
3. Response and resolution targets in the Service Level Agreement do not apply to issues caused by it.
4. Remediation work caused by it is Out-of-Scope Work, billed at standard rates.
5. SupportMax may ask Client to sign the Declined Security Recommendation Form in Schedule C. If Client neither signs nor responds within 10 business days, the recommendation is treated as declined.

If Client declines a recommendation SupportMax labels critical (for example, no MFA or no offsite backup), SupportMax may end the affected services on 30 days written notice without an early termination fee to either party.

Security, backups, ransomware and vendors

5.1 No guarantee of security. SupportMax will use commercially reasonable care and industry-standard tools to reduce cyber risk. Client understands that no service can prevent every attack, outage or data loss. SupportMax does not guarantee that the Covered Environment will be secure, error-free or uninterrupted.

5.2 Shared responsibility. SupportMax is responsible only for the security tasks listed in the Service Order and Schedule B. Client remains responsible for its own staff’s conduct, physical security, devices not enrolled in SupportMax’s tools, and decisions to decline recommendations.

5.3 Backups.

1. SupportMax will configure and monitor backups only for systems listed in the Service Order, on the schedule and retention stated there.
2. SupportMax will review backup job status each business day and open a ticket for any failed job, with a target to correct or re-run it within 1 business day.
3. SupportMax will run a test restore at least quarterly and give Client a written result.
4. Client is responsible for telling SupportMax about any new system or data store that needs backup. Data not listed is not backed up.
5. Backups depend on Third-Party Products. SupportMax does not guarantee any backup will be complete or restorable. SupportMax’s only obligation for a failed backup is to use reasonable efforts to restore from the most recent good copy and to fix the cause.
6. SupportMax is not liable for data created or changed after the last successful backup, or for data on systems not covered.

5.4 Ransomware and cyber events.

1. On a suspected Security Incident, SupportMax will follow Schedule B: contain, notify Client’s primary contact, and preserve evidence where practical.
2. SupportMax may isolate devices, disable accounts or cut network access without prior approval when it reasonably believes this will limit damage.
3. Client must notify its cyber insurer promptly and use the insurer’s breach coach, forensic firm and legal counsel where its policy requires.
4. SupportMax will not negotiate with, or pay, any threat actor.
5. Incident response, forensics, rebuilds and recovery beyond the first 4 hours of containment are Out-of-Scope Work billed at the emergency rate, unless the Service Order includes an incident-response retainer.
6. Any ransom, fines, notification costs and business interruption losses are Client’s responsibility and are meant to be covered by Client’s cyber insurance (Section 7.1).

5.5 Third-Party Products and vendors.

1. SupportMax resells or manages Third-Party Products. Those products are provided under the vendor’s own terms, which Client accepts when they are deployed.
2. SupportMax is not liable for the acts, omissions, outages, defects or breaches of any vendor, including a supply-chain attack on a tool SupportMax uses to manage Client’s systems, unless caused by SupportMax’s own gross negligence or willful misconduct.
3. If a vendor breach affects Client, SupportMax will notify Client within 24 hours of learning of it, take reasonable steps to contain the impact, and help Client pursue the vendor’s remedies.
4. SupportMax reviews its core tool vendors at least annually for security practices, and will tell Client which tools have access to its environment on request.

Regulated and confidential data

6.1 Client owns compliance. Client is solely responsible for knowing which laws and standards apply to its business and data, including HIPAA, CCPA/CPRA, GLBA, PCI-DSS, state breach-notification laws and professional rules such as State Bar confidentiality duties. SupportMax provides IT services; it does not provide legal or compliance advice and does not certify Client as compliant.

6.2 Disclosure and add-on terms. Client must tell SupportMax in writing before SupportMax handles any regulated data. Before work starts, the parties will sign the matching add-on: a HIPAA Business Associate Agreement, a CCPA Service Provider addendum, or a PCI responsibility matrix. If Client does not disclose regulated data, SupportMax has no liability for failing to apply controls those laws require.

6.3 Minimum necessary access. SupportMax will access Client data only as needed to deliver the services. SupportMax will not sell Client data or use it for any other purpose.

6.4 Confidentiality. Each party will protect the other’s confidential information with at least reasonable care and use it only for this Agreement. This duty survives 3 years after termination, and indefinitely for trade secrets and regulated data.

6.5 Breach cooperation. If a Security Incident involves regulated data, SupportMax will notify Client within 72 hours of confirming it (or sooner if a signed add-on requires) and give reasonable help with Client’s notifications. Client decides whether and how to notify regulators, customers and the public, and bears those costs.

6.6 Compliance assessments. Risk assessments, audit evidence collection, policy writing and compliance gap reviews are available as Out-of-Scope Work or a separate Service Order.

Insurance, subrogation, liability and indemnity

7.1 Insurance.

1. SupportMax maintains the insurance it decides is appropriate for its business. SupportMax does not promise to carry any particular type or amount of coverage, and Client should not rely on SupportMax’s insurance to cover Client’s losses.
2. Client will carry first-party cyber insurance (covering ransomware, business interruption, data restoration and breach response) with limits of at least $1,000,000, plus commercial general liability. If Client chooses not to, it accepts the uninsured risk as a Declined Recommendation under Section 4.7.
3. Client’s insurance is primary for Client’s own losses. SupportMax may help fill in insurance applications, but Client alone is responsible for their accuracy. SupportMax is not liable if a carrier denies, limits or rescinds Client’s coverage.

7.2 Waiver of subrogation. To the extent its policies allow, Client waives, and will have its insurers waive, any right of subrogation against SupportMax for losses covered by Client’s insurance. Client will ask its carriers for any endorsement needed to make this waiver effective. If a Client insurer still pursues SupportMax, Client will reimburse SupportMax’s reasonable defense costs to the extent the claim exceeds SupportMax’s liability cap in Section 7.3.

7.3 Limitation of liability. To the fullest extent the law allows, SupportMax’s total liability for all claims arising from this Agreement, in contract, tort, negligence or otherwise, is limited to the fees Client paid SupportMax in the 6 months before the event giving rise to the claim.

7.4 Excluded damages. Neither party is liable for indirect, incidental, consequential, special or punitive damages, including lost profits, lost revenue, lost data, business interruption, reputational harm or regulatory fines, even if advised they were possible.

7.5 Carve-outs. Sections 7.3 and 7.4 do not limit: Client’s payment obligations; either party’s liability for fraud, willful misconduct or gross negligence; or anything that cannot be limited under California Civil Code §1668.

7.6 Indemnification.

1. Client will defend and indemnify SupportMax against third-party claims arising from Client’s data, Client’s breach of law, Client’s Declined Recommendations, unlicensed software Client supplies, or the acts of Client’s staff.
2. SupportMax will defend and indemnify Client against third-party claims that SupportMax’s own proprietary deliverables infringe a U.S. intellectual property right, and claims caused by SupportMax’s gross negligence or willful misconduct.
3. The indemnified party must notify the other promptly, let it control the defense, and cooperate.

Errors, disputes and prior conditions

8.1 Notice and right to cure. If Client believes SupportMax or its staff made an error, Client will report it in writing within 30 days of discovering it. SupportMax will have 30 days to correct it. Client’s remedies for a missed service level are the service credits in Schedule A and the termination right in Section 9.4. For other errors, re-performance of the service, or a refund of fees paid for the faulty service if re-performance is not practical, is Client’s primary remedy, subject to Section 7.3.

8.2 Good-faith dispute process and public statements.

1. Escalate first. Before any lawsuit, public complaint or online review about a dispute, Client’s contact and SupportMax’s owner will meet within 10 business days of written notice to try to resolve it.
2. Mediation. If that fails, the parties will mediate in Los Angeles County for at least 30 days, sharing the mediator’s fee equally.
3. Confidential disputes. The parties will keep the details of any dispute and settlement confidential, except as law requires.
4. Mutual professional conduct. While a dispute is in this process, neither party will publish statements about the other that are false or misleading. Nothing here stops either party from posting truthful, honest reviews, reporting to a regulator, or making any statement protected by law.
5. Urgent relief. Either party may seek a court order to stop unauthorized use of confidential information or to collect unpaid fees without first finishing steps 1 and 2.

8.3 Pre-existing conditions. Before onboarding, SupportMax will perform a baseline assessment and give Client a written onboarding report. SupportMax is not responsible for any condition that existed before the Service Order start date, including prior compromises, misconfigurations, unpatched or unsupported systems, missing backups, or the work of prior IT providers. Fixing those conditions is Out-of-Scope Work unless the Service Order includes an onboarding remediation project. Undetected compromises that predate onboarding are Client’s risk.

8.4 Claims period. Any claim against SupportMax must be brought within one (1) year after the claiming party knew or reasonably should have known of the facts giving rise to it, and in any case no more than two (2) years after the services in question were performed. After that, the claim is waived. This does not apply to claims that cannot be shortened by law.

8.5 Records. SupportMax will keep ticket histories, patch reports, backup reports and recommendation records for at least 3 years. Those records are evidence of the services performed and of Declined Recommendations.

Term, fees, termination and transition

9.1 Term and pricing options. This Agreement continues until ended under this section. Each Service Order has its own term:

Each Service Order renews automatically for 12-month periods unless either party gives written notice at least 60 days before the end of the current term. SupportMax will send a renewal reminder at least 90 days before the end of the term.

9.2 Fees and payment. Monthly fees are billed in advance and due within 15 days. Late balances accrue 1.5% per month or the legal maximum, whichever is lower. SupportMax may suspend non-emergency services on 10 days written notice if fees are more than 30 days overdue. SupportMax may raise fees once per year by up to 5% on 60 days written notice, plus pass-through increases from vendors.

9.3 Early termination fee. Client may end a Service Order early for convenience on 60 days written notice. Client will then pay, as a reasonable estimate of SupportMax’s damages and not as a penalty: (a) all fees through the notice period; (b) 50% of the monthly fees remaining in the term after that; (c) any non-cancellable licenses or hardware committed for Client; and (d) unpaid onboarding costs, which are amortized over the term. Lower prices elsewhere or general dissatisfaction are not cause.

9.4 Termination for cause. Either party may end a Service Order if the other materially breaches and does not cure within 30 days of written notice. Missing the same service level priority target in 3 consecutive months, after notice and a chance to cure, counts as a material breach by SupportMax. No early termination fee applies to a termination for cause by Client.

9.5 Transition out. On termination, after Client pays all amounts due, SupportMax will:

1. Hand over administrative credentials, documentation and network diagrams it maintains for Client within 10 business days.
2. Provide a copy of Client data held in SupportMax-managed backups in a standard format.
3. Remove its agents and tools on an agreed date.
4. Provide transition help to a new provider at the hourly rate in the Service Order.

SupportMax may delete Client data from its systems 30 days after termination.

9.6 Survival. Sections on fees, confidentiality, liability, indemnity, disputes and claims period survive termination.

General provisions

10.1 Governing law and venue. California law governs this Agreement. After the steps in Section 8.2, any lawsuit must be filed in the state or federal courts located in Los Angeles County, California, and both parties consent to those courts. As an exception, either party may bring a claim for unpaid fees in small claims court without first completing Section 8.2. The prevailing party recovers reasonable attorneys’ fees and costs.

10.2 Non-solicitation. During the term and for 12 months after, Client will not directly hire a SupportMax employee or contractor who worked on Client’s account without paying a placement fee of 50% of that person’s first-year pay.

10.3 Force majeure. Neither party is liable for delays caused by events beyond its reasonable control, including utility, internet or cloud-provider outages, natural disasters, wildfire, pandemics, war and government action. Cyberattacks are handled under Section 5.4, not this section.

10.4 Independent contractor. SupportMax is an independent contractor. It may use vetted subcontractors and remains responsible for their work.

10.5 Remote access and monitoring consent. Client authorizes SupportMax to install monitoring, management and security agents on covered devices and to access them remotely. Client is responsible for telling its staff that company devices are monitored.

10.6 Notices. Legal notices must be in writing and sent by email with confirmation of receipt, or by courier, to the addresses in the Service Order.

10.7 Entire agreement and changes. This Agreement, its schedules and Service Orders are the entire agreement. Changes must be in writing and signed by both parties, except fee and policy updates allowed by Section 9.2 and Section 10.10. Client’s purchase orders do not change these terms.

10.8 Assignment. Client may not assign this Agreement without SupportMax’s written consent. SupportMax may assign it to a successor in a merger or sale of its business on written notice.

10.9 Severability and e-signatures. If any provision is unenforceable, it will be enforced to the maximum extent allowed and the rest remains in effect. Electronic signatures are binding.

10.10 Changes to posted terms. The current version of this Agreement and its schedules is posted at supportmax.com/legal/ with a version number and effective date. SupportMax may update the posted terms by emailing Client’s primary contact at least 30 days before the change takes effect. Each Service Order stays under the version in effect when it was signed until its next renewal, when the then-current version applies. A change Client must agree to under law, or that increases Client’s fees beyond Section 9.2, needs Client’s written acceptance.