Master Service
Agreement

Last updated: October 15, 2025

Summary

This Master Service Agreement (this “Agreement”) is entered into by and between Security Consultants OÜ, an Estonian private limited company, having its principal place of business at Tiskrevälja tn 59-12, Tallinn, 13516, Estonia (the “Company”), and the client entity identified in the applicable Statement of Work (the “Client”).

The Effective Date of this Agreement, as well as the duration of the contractual relationship, shall be the date and period specified in the applicable Statement of Work. The Client’s name and principal business address shall likewise be the name and address set forth in the applicable Statement of Work.

By signing the Statement of Work, the Client is deemed to have acknowledged, accepted, and entered into this Agreement in full. No additional signatures are required for this Agreement to become fully binding and to produce legal effect for both parties In consideration of the mutual covenants and promises made by the parties of this Agreement, Security Consultants OÜ and the Client (to be referred to individually herein as
“Party” and collectively as, the “Parties”) agree to the following:

1. Confidentiality

1.1. Confidential Information” shall mean any non-public proprietary information owned or controlled by a Disclosing Party. This includes information observed or examined from the Disclosing Party’s operations, trade secrets, designs, prototypes, data, financial information, etc.

1.2. Confidential Information does not include information that is public, was rightfully possessed prior to disclosure, received from a third party, or independently developed.

1.3. The Parties may exchange Confidential Information during the term of this Agreement in order to fulfil their contractual and/or legal obligations.

1.4. The Receiving Party shall protect Confidential Information with at least the same care as its own. Disclosure shall be limited to Representatives with a need to know basis, who are bound
by similar confidentiality obligations.

1.5. Confidential Information may be disclosed as required by law, provided the Disclosing Party is notified prior to such disclosure.

1.6. Upon request, the Receiving Party shall return or destroy all Confidential Information, retaining one copy only if necessary for business records.

2. Performance of Services

2.1. The Client may obtain services through the execution of a Statement of Work (SOW), subject to this Agreement's terms. The Company warrants services will be provided with reasonable skill and diligence in accordance with the provisions of the SOW.

2.2. The Company will perform services as described in the SOW, with diligence and using well-trained employees or subcontractors.

2.3. Service Level Agreements

Only the formally agreed communication channels (email and phone calls for incident
response, email, and instant messaging for general activities) are covered by the SLA.

2.3.1. Incident response support process

The Company does not operate a Security Operations Center; the incident response services aim to assist with incident management, providing guidance, consulting, and advice, but can not provide forensics, log analysis, cloud configuration/restoration, or other technical services as part of the vCISO service. If the client requires technical services, these will be provided on a case-by-case basis at an additional cost determined by the specific service required.

The Company will commit to the following SLAs during workdays (business hours) and out of
hours (nights and weekends) for incident response and participation:

vCISO/vDPO Premium

		Monday to Friday	Weekends and US Public Holidays Target Response Time
Severity Level	Description	24-hour service Target Response Time for Incident Response Support process initiation	Target Response Time for Incident Response Support process initiation.
L1- Critical	Major security breaches cause significant data loss, significant system outages, or regulatory exposure. Immediate response and senior leadership engagement required.	4 hours	8 hours
L2 - High	Security incidents impacting sensitive data or business operations, but contained or recoverable with coordinated response.	4 hours	8 hours
L3 - Moderate	Localized impact, such as a compromised user account or system, with no widespread exposure. Requires prompt remediation.	8 hours	12 hours
Level 4 - Low	Minimal impact or false positive. Logged for tracking and future risk assessment.	12 hours	12 hours

‍

vCISO/vDPO Basic

		Monday to Friday	Weekends and US Public Holidays
Severity Level	Description	Target Response (10:00 – 22:00 GMT / 05:00 – 17:00 EST/EDT / 02:00 – 14:00 PST/PDT)	Out of business hours SLA for all severity levels
L1- Critical	Major security/data breaches cause significant data loss, significant system outages, or regulatory exposure. Immediate response and senior leadership engagement required.	4 hours	8 hours
L2 - High	Security incidents impacting sensitive data or business operations, but contained or recoverable with coordinated response.	4 hours	8 hours
L3 - Moderate	Localized impact, such as a compromised user account or system, with no widespread exposure. Requires prompt remediation.	8 hours	8 hours
Level 4 - Low	Minimal impact or false positive. Logged for tracking and future risk assessment.	12 hours	8 hours

‍

2.3.2. General activities SLA

The Company commits to the following SLA for general activities during work hours:

Trigger	Description	Target Response Time 08:00 – 22:00 GMT	Target Response Time out of hours 22:00 – 08:00 GMT
General e-mail or chat message with questions	Email sent to the dedicated vCISO address, or chat message via Teams/Slack	4 hours	8 hours
Security Questionnaire	Email sent to the dedicated SQ email address	4 hours acknowledgment, 5 business days to deliver	8 hours acknowledgment, 5 business days to deliver
Meetings / Planned touchpoints	Participating in planned activities such as meetings, touchpoints, audits, vendor or client engagement calls	95% participation (approx 1 cancellation a year)

‍

2.4. The Company will measure the SLAs and provide quarterly business review reports to the Client. In the event of a failure of the combined SLA between 90% and 100%, 15% of the monthly fee will be refunded.

SLA	Refund
90-100% SLA	15% of the monthly fee
>90% SLA	30% of the monthly fee

‍

3. Amendments to Services

3.1. The Company shall meet the Client’s requests for amendment based on the contract insofar as this is possible for it within the scope of its operational capacities and the SOW and insofar as the execution of the request for amendment is appropriate and reasonable.

3.2. The Company may undertake minor amendments to the project without the client’s prior consent, provided that these comply with the client’s presumed will, are especially urgent, and the client cannot be contacted on time. The Company will inform the Client immediately about such project amendments and their impacts.

3.3. Insofar as the Company’s expenses increase due to a request for amendment by the Client or the project's time frame is extended, the contracting parties undertake to negotiate a corresponding appropriate adjustment to the SOW and the payment.

‍

4. Client's Duties to Cooperate

4.1. The successful implementation and delivery of the SOW requires the parties to work together closely. The Client will provide continuous and diligent support to the Company in the project work. The client will provide the Company with comprehensive information about all aspects material to the SOW, as well as documentation and information on time and in full.

4.2. The Client will:

reply to all questions raised by the Company deemed as relevant for its project work, in full, correctly, and at short notice to the best of its knowledge.
inform the Company without being requested to do so and in good time - and also in cases of doubt - about all circumstances which could be significant for the project.

4.3. The Client undertakes to provide assurance in writing and to the best of its knowledge regarding the completeness and correctness of the information handed over to the Company.

‍

5. Non-disclosure

5.1. The Company shall maintain confidentiality for two years after the conclusion of the contract.

5.2. Confidential information may be disclosed to necessary third parties with prior consent.

5.3. The non-disclosure obligation pursuant to Clause 5.1 does not apply to confidential information if and insofar as

a) this was already lawfully in the possession of the Company before the disclosure and without a non-disclosure obligation;

b) this was lawfully sent to the Company after the conclusion of the contract by a third party not subject to a non-disclosure obligation;

c) this was disclosed without the help of the Company or otherwise became generally known without its fault;

d) The Company is obligated on the basis of mandatory statutory provisions or official orders to disclose the information to authorities, the judiciary or other third parties;

e) the client has consented to the information being passed on by the Company.

5.4. The Company is entitled to disclose confidential information to the persons it uses to execute the contract, in particular its employees and sub-contractors, as well as persons obligated to non-disclosure as part of their profession, provided that the Company undertakes to obligate these persons to non-disclosure and to data protection.

5.5. The Company is authorized to process the personal data of the client entrusted to it within the scope of the intended purpose, or to have it processed by third parties.

‍

6. Incorporation of the Data Processing Agreement

The Parties acknowledge and agree that the Data Processing Agreement (“DPA”) executed or otherwise accepted between the Parties is hereby incorporated into and forms an integral part of this Agreement. The DPA sets forth the rights and obligations of the Parties with respect to the Processing of Personal Data pursuant to Regulation (EU) 2016/679 (“GDPR”) and any applicable data protection or privacy laws. To the extent that the Parties Process Personal Data under this Agreement, such Processing shall be governed by the terms of the DPA. In the event of any inconsistency between the DPA and this Agreement, the terms of the DPA shall prevail with respect to the Processing of Personal Data.

‍

7. Fees, Ancillary Costs, and Payment Terms

7.1. The Client shall compensate the Company as detailed in the SOW.

7.2. Payment of all invoices is due within fifteen (15) days of the invoice date unless disputed in good faith.

7.3. If any undisputed payment due from the Client remains unpaid for more than seven (7) days after the due date, the Company shall have the right to immediately suspend the provision of all Services, including work on any Deliverables under any Statement of Work or other agreement between the parties, without prior notice to the Client.

7.4. The Company shall bear no liability or responsibility for any losses, damages, or delays incurred by the Client as a result of such suspension of Services.

7.5. Furthermore, the Company may, at its sole discretion, choose to schedule or proceed with any project or service kick-off meeting only upon confirmation of receipt of the applicable payment.

7.6. In the event of any delay in payment by the Client beyond the agreed payment terms, the Company reserves the right, at its sole discretion, to postpone the delivery of any Deliverables specified in the applicable Statement of Work by a number of calendar days equivalent to the duration of the Client’s delay in making such payment. Such postponement shall not be considered a breach of the Company’s obligations, and the Company shall not be liable for any losses or damages arising from or related to such adjusted delivery timelines.

7.7. Applicable taxes are the Client’s responsibility, and payment is to be made by bank transfer or other agreed methods.

7.8. A late payment fee of five percent (5%) of the outstanding invoice amount shall be applied to any undisputed payment not received within seven (7) business days after the due date.

‍

8 . Use of Results and Intellectual Property Rights

8.1. The Client guarantees that any materials produced by the Company will only be used for the agreed purposes.

8.2. The Company retains ownership of any intellectual property generated through its services, with the Client receiving a non-transferable license to use the results as agreed.

‍

9. Terms and Termination

9.1. This Agreement commences on the Effective Date and continues for one (1) year unless terminated as per this section.

9.2. Either Party may terminate the Agreement with thirty (30) days' notice or immediately in case of a material breach or insolvency.

9.3. In the event that the Client terminates this Agreement without cause prior to its expiration date, the Client shall pay to the Company, within thirty (30) days from the effective date of such termination, an amount equal to eighty percent (80%) of the total remaining fees that would have been due for the remainder of the Term had this Agreement not been terminated early.

‍

10 . Force Majeure

10.1. Neither Party shall be liable for delays caused by unforeseen circumstances beyond their control, including natural disasters, strikes, or governmental actions.

‍

11 . Liability and Indeminification

11.1. The Company shall indemnify the Client against liabilities arising from the Company’s gross negligence or willful misconduct.

11.2. The Client shall indemnify the Company against liabilities arising from the Client’s negligence or misconduct.

‍

12 . Terms and Termination

12.1. This Agreement commences on the Effective Date and continues for one (1) year unless terminated as per this section.

12.2. Either Party may terminate the Agreement with thirty (30) days' notice or immediately in case of a material breach or insolvency.

12.3. Upon termination, the Client must pay for the services performed up to the termination date, and all provisions meant to survive termination shall remain in effect.

‍

13. Governing Law

13.1. This Agreement shall be governed by the laws of Ireland. Disputes will be resolved through negotiation between senior executives of the Parties.

‍

14. Miscellaneous

14.1. Independent Contractor: Company shall perform its duties as an Independent Contractor.

14.2. Amendment: Any amendment to this Agreement must be in writing and signed by authorized representatives of both Parties.

14.3. Notices: Notices shall be deemed given on the date received if delivered personally or electronically, or three days after postmarked if sent by certified mail.

14.4. Waiver: Waivers must be in writing and do not constitute continuing waivers.

14.5. Severability: If any provision is unenforceable, it shall be replaced with a valid provision that closely reflects the original intent.

14.6. Entire Agreement: This Agreement and any applicable SOW constitute the entire agreement between the Parties.