SOC Subscription Agreement
This Subscription Agreement is entered into by and between AG1, Inc (dba AgileBlue), with a principal place of business at 9000 Sweet Valley Drive, Cleveland, Ohio 44125 (“AgileBlue”) and Company Name with a principal place of business at Company Address (“Subscriber”) and is effective as of _________________, 2024 (the “Effective Date”). In consideration of the mutual obligations set forth hereinafter and intending to be legally bound, AgileBlue and Subscriber agree as follows:
- Subscription Rights. In consideration of Subscriber’s payment of the fees and compliance with the terms herein, AgileBlue grants Subscriber a non-exclusive, nontransferable right for the Subscription period ordered (unless earlier terminated pursuant to the terms of this Agreement) to use the Service solely for Subscriber’s internal business use.
- Charges and Payment of Fees. Subscriber shall pay AgileBlue the Annual Subscription fees in effect at the time the fees or charges are due and payable. The fees in effect as of the Effective Date are listed below. Subscriber may pay the stated Subscription fee monthly or annually. If the Subscriber elects to pay monthly, then the Subscriber agrees to pay AgileBlue with an automatic reoccurring ACH payment due on the 1st of every month. If the Subscriber elects to pay annually, AgileBlue shall invoice 12 months of cumulative Subscription fees less a 5% annual discount up front, which must be paid within fifteen (15) days of the acceptance of this Agreement.
• Services: 24X7 SOC-as-a-Service | XDR Platform | Continuous Vulnerability Scanning: See APPENDIX A
• Fees: Subscriber will pay $X,XXX per month, which equates to $XX,XXX annually and includes a 5% discount to pay upfront instead of monthly. The annual invoice will be generated upon agreement signing and prorated as needed.
• Continual Vulnerability Scanning: $X,XX per month
• Setup fees: $5,000 will be waived for this 36-month agreement if signed by XX/XX/202X
• Start date: XX/XX/202X
- Billing and Renewal. AgileBlue charges and collects in advance for use of the Service. AgileBlue will automatically renew and initiate debits with Subscriber’s bank or financial institution for monthly charges or issue an invoice to Subscriber each year on the subsequent anniversary for annual service. The renewal charge will be equal to the service fees in effect during the prior term, unless AgileBlue has given Subscriber at least 30 days prior written notice of a fee increase, which shall be effective upon renewal and thereafter. Fees for other services will be charged on an as-quoted basis. AgileBlue’s fees are non-refundable and are exclusive of all taxes, levies, or duties imposed by taxing authorities, and Subscriber shall be responsible for payment of all such taxes, levies, or duties, excluding only United States (federal or state) taxes based solely on AgileBlue’s income. Invoices will not be re-calculated unless Subscriber consistently exceeds 10% increase on devices being monitored for two consecutive months. The increase will be the per device cost the Subscriber is currently paying per the new added devices. Subscriber agrees to provide AgileBlue with complete and accurate billing and contact information. This information includes Subscriber’s legal company name, street address, e-mail address, and name and telephone number of an authorized billing contact. AgileBlue reserves the right to increase the monthly/annual fee after year one of the Initial Term, up to 5% per annum for general economic increases.
- Non-Payment and Suspension. In addition to any other rights granted to AgileBlue herein, AgileBlue reserves the right to suspend or terminate this Agreement and Subscriber’s access to the Service if Subscriber’s account becomes delinquent (falls into arrears). Delinquent invoices (accounts in arrears) are subject to interest of 1.5% per month on any outstanding balance, or the maximum permitted by law, whichever is less, plus all expenses of collection. Subscriber will continue to be charged for Licenses during any period of suspension. If Subscriber or AgileBlue initiates termination of this Agreement, Subscriber will be obligated to pay the balance due on its account computed in accordance with the Charges and Payment of Fees section above. Subscriber agrees that AgileBlue may collect or charge such unpaid fees to Subscriber through a debit authorization with Subscriber’s bank or financial institution, or by invoicing Subscriber for such unpaid fees. AgileBlue reserves the right to impose a reconnection fee in the event Subscriber is suspended and thereafter requests access to the Service. Subscriber agrees and acknowledges that AgileBlue has no obligation to retain Subscriber Data (defined below), and that such Subscriber Data may be irretrievably deleted if Subscriber’s account is 30 days or more delinquent.
- Subscriber Data. Subscriber Data is defined as the raw log files from any device (server, workstation, or firewall) AgileBlue is monitoring. AgileBlue does not own any Subscriber Data. AgileBlue will not share, distribute, or print any Subscriber Data except as may be required by this service and the law. Upon termination for cause, Subscriber’s right to access or use Subscriber Data immediately ceases, and AgileBlue will have no obligation to maintain or forward any Subscriber Data.
- Confidentiality. In the course of performance of this Agreement, both parties acknowledge that each will obtain or gain access to non-public information that is confidential and proprietary to the other (“Confidential Information”). The parties agree that any AgileBlue intellectual property and technology and Subscriber Data. Each party will (a) only use the other party’s Confidential Information for the purposes contemplated by this Agreement; (b) not use for its own benefit or knowingly disclose to, or use for the benefit of, any other person any Confidential Information without the other party’s prior written consent; (c) use at least the same degree of care and caution to protect the other party’s Confidential Information from disclosure that it employs with respect to its own confidential information, but in no event less than a reasonable degree of care and caution; (d) disclose Confidential Information only to those of its employees, agents, consultants or contractors who require access to it in order for the party to be able to perform its obligations under this Agreement; and (e) take appropriate action by instruction, agreement or otherwise with persons allowed such access to satisfy the foregoing obligations. This section will not apply to any information which (i) is or becomes publicly available through no fault of the receiving party; (ii) is already in the receiving party’s possession without restriction on disclosure when disclosed by Subscriber; (iii) is independently developed by the receiving party without use of the Confidential Information of the disclosing party; (iv) is rightfully obtained by the receiving party from a third party without violating the rights of the disclosing party; or (v) is required to be disclosed pursuant to a court of law.
- Representations:
- AgileBlue provides security analysis and alert response services as set forth above in this Agreement and on Appendix A. However, Subscriber acknowledges and agrees that deployment of the Services does not eliminate the risk of security incidents, and therefore, AgileBlue makes no guarantee that intrusions, compromises, or any other unauthorized activity or security incidents will not occur on Subscriber’s network.
- The Service Levels defined in Appendix A will not apply to the extent Subscriber does not fulfill and comply with its obligation to cooperate with AgileBlue.
- A “security incident” is defined as one or more security events that evidence a malicious and material security threat that is deemed high severity by AgileBlue, as determined at AgileBlue’s sole discretion. Subscriber is solely responsible for any suspected or actual security breach of Subscriber’s systems, data and other confidential information that Subscriber maintains, possesses or otherwise accesses. In the event AgileBlue becomes aware of a Subscriber security breach when providing the Services, AgileBlue will endeavor to promptly notify Subscriber of such breach. Subscriber will fully cooperate with AgileBlue to assess the nature and scope of the breach. Subscriber will use its best efforts to prevent further unauthorized access, use or disclosure of the Subscriber’s systems and/or data and will provide periodic updates to AgileBlue.
- Limited Warranties, Limitations of Liability, and Indemnity.
- Limited Warranty. AgileBlue warrants, for the benefit solely of Subscriber, that the Services will be provided in a competent and professional manner and shall be in accordance with the practices and quality standards reasonably applicable to similar services.
- Disclaimer of Other Warranties. EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, THERE ARE NO WARRANTIES, EXPRESS OR IMPLIED, BY OPERATION OF LAW OR OTHERWISE, REGARDING OR RELATING TO THE SERVICES OR TO ANY OTHER MATERIALS, GOODS OR SERVICES FURNISHED TO SUBSCRIBER HEREUNDER OR IN CONNECTION HEREWITH. AGILEBLUE SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING WITHOUT LIMITATION THOSE OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. NO REPRESENTATION OR OTHER AFFIRMATION OF FACT, INCLUDING BUT NOT LIMITED TO STATEMENTS REGARDING CAPACITY, SUITABILITY FOR USE OR PERFORMANCE OF PRODUCTS, WHETHER MADE BY AGILEBLUE EMPLOYEES OR OTHERWISE, WHICH IS NOT CONTAINED IN THIS AGREEMENT, WILL BE DEEMED TO BE A WARRANTY BY AGILEBLUE FOR ANY PURPOSE OR GIVE RISE TO ANY LIABILITY OF AGILEBLUE WHATSOEVER. WITHOUT LIMITING THE FOREGOING, AGILEBLUE SERVICES ARE NOT INTENDED TO PREVENT CYBER ATTACKS OR BREACHES, RATHER, TO INCREASE AWARENESS AND VISIBILITY TO THE INCIDENT WHERE CYBER CRIMINALS HAVE BREACHED THE COMPANY DEFENSES.
- Limitation of Liability. Regardless of the form of action, IN NO EVENT SHALL EITHER PARTY’S AGGREGATE LIABILITY EXCEED THE AMOUNTS ACTUALLY PAID TO AGILEBLUE IN THE TWELVE (12) MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO SUCH CLAIM, OR WITH RESPECT TO A BREACH OF SUBSCRIBER’S PAYMENT OBLIGATIONS, THE AMOUNT OWED BY SUBSCRIBER. IN NO EVENT SHALL EITHER PARTY AND/OR ITS LICENSORS BE LIABLE TO ANYONE FOR ANY INDIRECT, PUNITIVE, SPECIAL, EXEMPLARY, INCIDENTAL, CONSEQUENTIAL OR OTHER DAMAGES OF ANY SIMILAR KIND (INCLUDING LOSS OF DATA, REVENUE, PROFIT OR OTHER ECONOMIC ADVANTAGE) ARISING OUT OF, OR IN ANY WAY CONNECTED WITH THIS SERVICE, INCLUDING BUT NOT LIMITED TO THE USE OR INABILITY TO USE THE SERVICE, OR FOR ANY CONTENT OBTAINED FROM OR THROUGH THE SERVICE, ANY INTERRUPTION, INACCURACY, ERROR OR OMISSION, REGARDLESS OF CAUSE IN THE CONTENT, EVEN IF THE PARTY FOR WHICH DAMAGES ARE BEING SOUGHT OR SUCH PARTY’S LICENSORS HAVE BEEN PREVIOUSLY ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT WILL AGILEBLUE HAVE ANY LIABILITY FOR THIRD PARTY PRODUCTS OR SERVICES, INCLUDING WITHOUT LIMITATION THOSE BUNDLED, INTEGRATED OR OTHERWISE ASSOCIATED WITH AGILEBLUE PRODUCTS OR SERVICES.
- Term and Termination. The term of this Agreement commences on the Effective Date and will continue for three (3) years thereafter (the “Initial Term”) The Agreement shall automatically renew for subsequent twenty-four (24) month period unless either party notifies the other party in writing at least ninety (90) days prior to the next-scheduled renewal date (each, a “Renewal Term”). Either party may terminate this Agreement by notifying the other party in writing at least ninety (90) days prior to the end of the then-current Initial Term or Renewal Term.
- Assignment. Subscriber may not assign this Agreement without AgileBlue’s written consent. AgileBlue may assign its rights and obligations under this Agreement without Subscriber’s consent.
- Entire Agreement; Modifications. This document contains the entire agreement between the parties relating to the matters covered by it, superseding all other oral or written representations, understandings, proposals or other communications between the parties. This Agreement may be modified only by a written instrument signed by an authorized representative of each party.
- Severability. In the event that any provision of this Agreement is for any reason void or unenforceable in any respect, such provision will be without effect to the extent of the voidness or unenforceability without affecting such provision in any other respect and without affecting any other provision.
- Governing Law. This Agreement will be governed by the substantive laws (but not the conflicts of law’s provisions) of the State of Ohio.
- Force Majeure. In no event will either party be liable for any delay or failure to perform under this Agreement (except obligations to make payments as and when due) that is due to causes beyond the reasonable control of such party, such as strikes, work stoppages, accidents, acts of war or terrorism, civil or military disturbances, epidemics, pandemics or government-ordered shutdowns, natural catastrophes or acts of God; it being understood that such party shall use reasonable efforts to resume performance as soon as practicable under the circumstances.
APPENDIX A: Scope of Product and Services
Subscriber is entitled to the following license and services within the terms of this Agreement and the pricing detailed in Section 2, above. Invoices will not true-up unless Subscriber exceeds a 10% increase in monitored devices for 60 days.
• Cloud-based SOC | XDR | SOAR Version License
○ SOC-as-a-Service
○ XDR | EDR(Fully Managed)
○ SOAR
• Subscriber On-Boarding:
○ AgileBlue will assist Subscriber in completing the installation and on-boarding
○ AgileBlue will provide Subscriber with complete training on the SOC|XDR Platform
• Daily log file size ~50GB per day: AgileBlue will collect security event logs from log-emitting log sources
• ~XXXX Log Sources:
○ Servers: X Windows
○ Workstations: ~XXXX (Windows with ~XXX Macs)
○ Office365 or GSuite Integration
○ Cloud: AWS, Azure Cloud, Azure AD Integration
○ Network Devices = XXXX
• 24/7/365 Monitoring, Threat Hunting, Detection and Alerting Operations Team deliverables:
○ Conduct high level analysis of security events detected
○ Promptly notify Subscriber of a security incident as set forth in the SLA below
• Incident notifications within (SLA):
○ 30-60 minutes for Critical and High criticality alerts
○ 2-4 hours on all other alerts
• Internal and External Risk Scoring Engine with Continual External Scans
• Continual Vulnerability Scanning: AgileBlue will run vulnerability scanning and present priority patch report to company for patching (optional).
• Managed Cloud-Based SIEM. AgileBlue will collect security event logs from applications and devices that are generated in Subscriber’s environment and that are expressly listed on the Subscriber Portal (“Monitored Devices”), which may be modified from time to time by AgileBlue.
• Real-time notifications and alerts
• Machine Learning
• Access to online dashboards
• AgileBlue will provide a report and conduct a virtual meeting to Subscriber summarizing details, activities, recommendations, and tuning adjustments monthly.
• AgileBlue will retain Subscriber Data that is directly related to and necessary for the performance of the Services, as determined by AgileBlue, and acquired from data sources during this Agreement for a period of 90 days. AgileBlue will not store any events, logs or data that is not directly related to and necessary for the performance of the Services as determined solely by AgileBlue.
• AgileBlue will notify Subscriber of planned down-time and maintenance windows if, in AgileBlue’s sole discretion, it believes Services will be materially impacted.