inforcer Terms & Conditions

1.    INTERPRETATION

1.1    The following definitions apply in this Agreement:

“Account Country” means the country/territory associated with the address designated in Client’s account.

“Additional Subscriptions” has the meaning given in clause 3.1.

"Agreement" means these T&Cs, the Order Form and any DPA.

"AI Legislation" means Regulation (EU) 2024/1689 and any equivalent legislation in the United Kingdom or other applicable jurisdiction, in each case as amended from time to time.

"Beta Features" means features, modules or Services (or components thereof) that the Supplier makes available to the Client on a beta, pilot, early-access, evaluation or preview basis, whether or not designated as such, and including any Service offered without charge or at a promotional rate during a Ramp Period.

"Billable End User" means, where specified in the Order Form, an active Microsoft 365 user within a Tenant for which per-End-User pricing applies.

"Billing Metric" means the applicable unit of measurement used to calculate the Fees for a Service SKU, as specified in the applicable Order Form, including without limitation:
(a)    per Tenant;
(b)    per Billable End User; 
(c)    fixed annual licence;
(d)    unlimited-use subscription; or
(e)    any combination of the foregoing. 

"Business Day" means a day (other than a Saturday, Sunday or public holiday) on which banks are open for business in: (a) London, England for Clients in Europe and all other jurisdictions not specified in (b) or (c); (b) Tampa, Florida, USA for Clients in North America; or (c) Melbourne, Australia for Clients in Australia or New Zealand.

"Confidential Information" means all information that is proprietary or confidential and is either clearly labelled as such or identified as such in clause 12.4 or clause 12.5.

"Client" means the entity identified in the Order Form.

"Client Data" means data inputted by or on behalf of the Client for the purpose of using the Services.

“Client Personal Data” has the meaning set out in the DPA.

"Customer Client End User" means any individual whose Microsoft 365 account or resources are subject to monitoring, analysis or Response Actions through the Services.

"Data Protection Legislation" means all applicable laws, rules, regulations, and governmental requirements relating to the privacy, confidentiality, or security of Client Personal Data in force from time to time as they may be amended or otherwise updated from time to time, including (without limitation): (a) the GDPR; (b) all federal and state laws relating to data protection, the processing of Personal Data, privacy and/or data protection in force from time to time in the United States; and (c) the Swiss Federal Act on Data Protection of 25 September 2020 and the Swiss Data Protection Ordinance of 31 August 2022, and any new or revised version of these laws that may enter into force from time to time.

"Documentation" means the user documentation for the Services made available at www.inforcer.com or such other address notified by the Supplier.

"Effective Date" means the date specified in the Order Form.

"End User" means the Client, the Client's customers or any third party to which the Client provides Managed Services.

"Fees" means the fees payable for the Services including Subscription Fees, Support Services fees and other applicable fees payable for the Services pursuant to the terms of the Agreement or as set out in the Order Form.

"GDPR" means Regulation (EU) 2016/679 (the "EU GDPR") or, where applicable, the "UK GDPR" as defined in section 3 of the Data Protection Act 2018.

“Inforcer Application Library” means the managed library (powered by Devicie) of pre-packaged, automatically updated third-party applications for deployment across Microsoft Intune tenants.

"Initial Subscription Term" means the period specified in the Order Form (or twelve months if not specified), commencing when full subscription pricing first becomes payable. Any Ramp Period shall precede but not form part of the Initial Subscription Term.

"Insolvency Event" means any of the following: (a) either party suspends, or threatens to suspend, payments of its debts, or is deemed unable to pay its debts within the meaning of Section 123 of the Insolvency Act 1986; (b) an order is made or a resolution is passed for the winding up of either party, save for the purpose of a solvent reconstruction or amalgamation with the resulting entity assuming all the obligations of the entity that has been wound up; (c) either party goes into liquidation (voluntary or otherwise) other than a genuine solvent reconstruction or amalgamation; (d) either party suspends, or threatens to suspend, or ceases or threatens to cease, to carry on all or a substantial part of its business; or (e) if any event analogous to events described under (a) – (d) above shall occur in any other jurisdiction to which either party is subject.

"Intellectual Property Rights" means any patent, copyright, trade name, trademark, trade secret, know-how, or any other intellectual property right or proprietary right whether registered or unregistered, and whether now known or hereafter recognized in any jurisdiction.

"Managed Services" means the managed services provided by the Client to its End Users which incorporate the Services as part of a broader service offering, including without limitation support, administration, configuration, monitoring, or value-added services.

"Microsoft Graph" means Microsoft’s Graph API and related Microsoft 365 APIs and endpoints.

"Microsoft Security Policies" means policies managing the security of a Tenant, including conditional access policies and Microsoft Graph consents.

"Microsoft Tenant" or "Tenant" means a Microsoft 365 account held by the Client or managed by the Client on behalf of an End User.

"Normal Business Hours" means 9:00am to 5:30pm on a Business Day in: (a) UK time, for Clients in Europe; (b) Melbourne time, for Clients in Australia or New Zealand; or (c) Eastern time, for Clients in North America.

"Order Form" means the order form specifying the Service SKU(s), User Subscriptions, Initial Subscription Term and Fees.

"Personal Data" has the meaning set out in the DPA.

"Premium Tenant Licence" means a subscription Service SKU as further described in the Order Form.

"Ramp Period" means any period prior to the Initial Subscription Term during which free, discounted or promotional pricing applies.

"Renewal Period" means the period described in clause 15.1.

"Reports" means assessments, analyses and other outputs made available through the Services.

"Response Actions" means automated or Supplier-initiated actions taken through the Services on a Tenant or Microsoft 365 resources, including disabling accounts, revoking sessions, requiring MFA, blocking sign-in, quarantining mailboxes or modifying security configurations.

"Retail Prices Index" means the Retail Prices Index (all items, excluding mortgages) published by the Office for National Statistics, or any replacement index.

“Security Services” has the meaning given in Part 2 of Schedule 1.

"Service SKU" means a subscription product offered by the Supplier (including Premium Tenant Licence, Standard Tenant Licence and Tenant Assessment Licence), each with its own Billing Metrics and features as specified in the Order Form.

"Services" means the User Subscriptions and Support Services provided under this Agreement as set out in the Order Form.

"Software" means the online software applications provided as part of the Services.

"Standard Tenant Licence" means a subscription Service SKU as further described in the Order Form.

"Statistical Data" means aggregated, de-identified or anonymised data derived from use of the Services that does not identify the Client, any End User or any natural person.

"Subscription Fees" means the fees payable for User Subscriptions as set out in the Order Form.

"Subscription Term" has the meaning given in clause 15.1 (being the Initial Subscription Term together with any subsequent Renewal Periods).

“Supplier” means the Supplier Contracting Party identified in the table below, based on Client’s Account Country. If Client changes Client’s Account Country to one that is identified with a different Supplier Contracting Party, Client agrees that the Supplier Contracting Party identified with Client’s new Account Country is Client’s Supplier Contracting Party, without any further action required by either Party.

“Supplier Contracting Party”:

"Support Services" means the technical support services provided by the Supplier which includes maintenance and support such as the provision of updates (including bug fixes, patches and releases) for the Services.

"System Data" means data generated by the Supplier in connection with operation of the Services, including security telemetry, detection signals, threat data and performance metrics, but excluding Personal Data.

"Tenant Assessment Licence" means a subscription SKU as further described in the Order Form.

"User Subscriptions" means the subscriptions purchased by the Client, measured by the Billing Metric and in accordance with any minimum volume commitments specified in the Order Form.

"Virus" means any thing or device (including any software, code, file or programme) which may: prevent, impair or otherwise adversely affect the operation of any computer software, hardware or network, any telecommunications service, equipment or network or any other service or device; or adversely affect the user experience, including worms, trojan horses, viruses and other similar things or devices.

"Vulnerability" means a weakness in the computational logic (for example, code) found in software and hardware components that, when exploited, results in a negative impact on the confidentiality, integrity, or availability. 

2.    USER SUBSCRIPTIONS

2.1    The Supplier hereby grants to the Client a non-exclusive, non-transferable, non-sublicensable (other than for the purpose of permitting access to the Services to Client-managed Tenants) right to use the Services and the Documentation for the specific Service SKU(s) for the duration and scope set out in the Order Form.

2.2    The Client may sublicense the Services to End Users solely for the purpose of delivering its Managed Services. The Client shall not otherwise sublicense, resell or distribute the Services to any third party without the Supplier's prior written consent, which may be subject to additional charges.

2.3    In relation to the User Subscriptions, the Client undertakes that:
(a)    the Client's use of the Services shall not exceed the quantities, Billing Metrics or usage thresholds set out in the applicable Order Form;
(b)    the User Subscriptions will be managed by the Client, and the Client will at all times be responsible for the access to the Services and will not share or permit any passwords to be shared; and
(c)    the Client has secured, or will secure, permission from each End User for the provision of the Services for the benefit of the End User, including the End User’s consent to the placement of any resulting application or Software on each End User's Microsoft account.

2.4    The Client shall not, and shall procure that its End Users do not:
(a)    access, store, distribute, introduce or permit the introduction of, any Virus or Vulnerability into the Supplier’s network and information systems; 
(b)    transmit any material that is unlawful, harmful, threatening, defamatory, obscene, infringing, harassing, racially or ethnically offensive, facilitates illegal activity, depicts sexually explicit images, promotes unlawful violence, is discriminatory based on race, gender, colour, religious belief, sexual orientation, or disability, or is otherwise illegal or causes damage or injury to any person or property;
(c)    copy, modify, duplicate, create derivative works from, republish, or distribute all or any portion of the Software and/or Documentation; 
(d)    attempt to de-compile, reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Software; 
(e)    access the Services or Documentation to build a competing product or service, or conduct benchmarking or performance testing for publication or competitive analysis;
(f)    use the Services or Documentation to provide services to third parties, or license, sell, rent, lease, transfer, assign, or otherwise make the Services or Documentation available to any third party, other than to Client-managed Tenants as set out in clause 2.1; 
(g)    conduct penetration testing, vulnerability scanning, or other security testing of the Services or bypass or circumvent any security measure, access control, or technical restriction implemented by the Supplier;
(h)    use the Services for any malicious, fraudulent or unlawful purpose, or to interfere with the use of the Services by any other person; or
(i)    fail to use commercially reasonable endeavours to prevent any unauthorised access to, or use of, the Services and/or the Documentation including by disclosing or permitting the use of login credentials by any individual who is not authorised to access the Services. The Client shall promptly notify the Supplier upon becoming aware of any such unauthorised access or use and shall immediately disable any compromised credentials. The Supplier may refuse to issue replacement credentials to any individual responsible for, or involved in, such unauthorised access or use.

The Supplier reserves the right to disable, without notice, the Client’s access to the Services if there is a breach of this clause 2.4.

2.5    Where the Client purchases a Service SKU listed in Schedule 1 (Service SKU Terms), the additional terms set out in Part 1 of Schedule 1 for that Service SKU shall apply.

2.6    Where the Client purchases Security Services, the additional terms set out in Part 2 of Schedule 1 shall apply.

3.    SUBSCRIPTION QUANTITY CHANGES

3.1    The Client may add User Subscriptions at any time by written notice or, where available, through the platform's self-service functionality (“Additional Subscriptions”). Additional Subscriptions are subject to this Agreement, and use of self-service functionality constitutes acknowledgement of the change in usage and associated Fees. Additional Subscriptions may be added in respect of per-Tenant subscription services and additional Billable End User licences may be added in respect of per-Billable End User licensed services, subject to the different charging mechanisms set out in clauses 3.3 and 4.4.

3.2    The Client may request Additional Subscriptions (including upgrades) at any time by written notice to the Supplier which shall be subject to the Supplier’s written acceptance. Once accepted, the Fees shall be adjusted on a pro-rata basis and billed in accordance with clause 3.3, clause 4.4 and clause 10, as applicable.

3.3    Where Additional Subscriptions are added in respect of per-Tenant subscription services part way through the Initial Subscription Term or any Renewal Period (as applicable), the Fees for such Additional Subscriptions shall be pro-rated from the date of addition until the end of the then-current monthly billing period and billed in arrears on the Client’s next invoice. Such Additional Subscriptions shall be co-termed with the existing Subscription Term and shall thereafter form part of the Client’s contracted subscription quantity for the remainder of the Initial Subscription Term or Renewal Period (as applicable), unless the Order Form provides otherwise.

3.4    Where Services are licensed on a per-Billable End User basis, additional Billable End User licences purchased during the Subscription Term shall be charged in accordance with clause 4.4(b) and shall not be treated as fixed per-Tenant Additional Subscriptions for the purposes of clause 3.3. 

4.    USAGE AUDITS

4.1    The Supplier may conduct usage audits during the Subscription Term to verify compliance with applicable Billing Metrics. The Client shall permit such audits and provide reasonable access to the Supplier.

4.2    If an audit reveals that the Client has deployed, activated or otherwise utilised more User Subscriptions, Tenant licences or Billable End User licences than have been purchased or otherwise authorised under the applicable Order Form or this Agreement, the Client shall pay the applicable Fees for such additional licences in accordance with the Fees set out in the Order Form and this Agreement. Any underpayment revealed by an audit shall be payable by the Client and will be included on the Client’s next monthly bill.

4.3    Where per-Billable End User pricing applies, the Client shall not take any steps intended to avoid or artificially reduce Billable End User counts, including by disabling, rotating, reassigning or otherwise manipulating user identities.

4.4    The Client agrees and acknowledges that the following charging mechanisms apply during the Subscription Term: 
(a)    in respect of per-Tenant subscription services, where the Client adds Additional Subscriptions during the Subscription Term, the Fees for such Additional Subscriptions shall be pro-rated from the date they are added until the end of the then-current monthly billing period and billed in arrears on the Client's next monthly bill. Such Additional Subscriptions shall be co-termed with the existing Subscription Term and shall thereafter form part of the Client’s contracted subscription quantity for the remainder of the Subscription Term and be billed in accordance with the applicable Order Form. Upon any auto-renewal, the applicable subscription level and Fees shall renew at the total number of Tenant subscriptions in effect immediately prior to the renewal date; or 
(b)    in respect of per-Billable End User licensed services, the Client shall pay the minimum volume commitment amount specified in the applicable Order Form (“MVC Amount”). The Client may purchase additional Billable End User licences above the MVC Amount during the Subscription Term, including through the platform’s self-service functionality or by requesting such licences from the Supplier. Fees for additional Billable End User licences shall be pro-rated from the date of addition until the end of the then-current monthly billing period and included on the Client's next monthly bill. The Client may subsequently request a reduction in the number of Billable End User licences, provided that the total number of Billable End User licences shall not at any time be reduced below the MVC Amount. Any such reduction shall be subject to the Supplier's acceptance and shall be reflected in the Client's next monthly bill. Additional Billable End User licences shall not increase the MVC Amount during the then-current Subscription Term unless expressly agreed in writing or set out in the applicable Order Form. Upon any auto-renewal, the MVC Amount for the Renewal Period shall be the greater of: (A) the existing MVC Amount; or (B) the number of Billable End User licences in effect immediately prior to the renewal date.

5.    SERVICES

5.1    The Supplier shall, during the Subscription Term, provide the Services and make available the Documentation to the Client.

5.2    The Supplier shall use commercially reasonable endeavours to make the Services available 24 hours a day, seven days a week, except for:
(a)    planned maintenance carried out during the maintenance window of (i) 8:00pm to midnight local UK time for Clients located in Europe, (ii) 8:00pm to midnight Melbourne, Australian time for Clients located in Australia and New Zealand and (iii) 8:00pm to midnight Eastern Standard Time for Clients located in North America; as applicable; and
(b)    unscheduled maintenance performed outside Normal Business Hours, provided that, except in the case of an emergency, the Supplier has used reasonable endeavours to give the Client at least 2 Normal Business Hours' notice in advance.

5.3    The Supplier will, in consideration of the Fees, provide the Client with the Supplier's standard client Support Services, as agreed by the parties, during Normal Business Hours. The Supplier may amend its standard client Support Services in its sole and absolute discretion from time to time.

5.4    The Services available to the Client are limited to the functional scope of the applicable Service SKU(s) purchased. The Supplier may modify or update a SKU provided such modification does not materially reduce core functionality during the applicable Subscription Term.

5.5    The Client acknowledges that the Supplier continuously monitors the Services to: (a) provide the Services, including detecting, investigating and responding to actual or suspected security incidents, threats or vulnerabilities affecting the Services or any Tenant; (b) monitor capacity, performance, integrity and stability of the Supplier's infrastructure; (c) detect and remediate technical issues; (d) detect and address misuse of, unauthorised access to, or breach of the restrictions on use of, the Services; and (e) generate System Data and Statistical Data in accordance with clause 11.2. Such monitoring is conducted in compliance with clause 6 where Personal Data is involved.

6.    CLIENT DATA

6.1    The Client shall own all right, title and interest in Client Data that is not Personal Data and shall have sole responsibility for its legality, reliability, integrity, accuracy and quality.

6.2    The Supplier shall comply with its privacy and security policy available at www.inforcer.com/privacy (as updated from time to time).

6.3    The processing of Personal Data in connection with the Services shall be governed by the data processing addendum available at Inforcer Data Processing Addendum (the "DPA"). In the event of conflict between the DPA and this Agreement, the DPA shall prevail in respect of data processing matters.

7.    THIRD PARTY PROVIDERS

7.1    The Client acknowledges that the Services may enable access to third-party websites and services. Any use of, transactions with, or contracts entered into with third parties is solely at the Client's own risk, and the Supplier makes no representation, warranty or commitment regarding any third party.

7.2    The Services may include integrations with third-party platforms (including the Inforcer Application Library and PSA ticketing). The Client's use of such integrations is subject to the applicable third-party terms, and the Supplier shall have no liability for any third-party platform's performance, availability or integration with the Services.

8.    SUPPLIER'S OBLIGATIONS

8.1    The Supplier undertakes that the Services will be performed substantially in accordance with the Documentation and with reasonable skill and care.

8.2    The undertaking at clause 8.1 shall not apply to the extent of any non-conformance which is caused by use of the Services contrary to the Supplier's instructions, or modification or alteration of the Services by any party other than the Supplier or the Supplier's duly authorised contractors or agents. If the Services do not conform with the foregoing undertaking, the Supplier will, at its expense, use reasonable commercial endeavours to correct any such non-conformance promptly, or provide the Client with an alternative means of accomplishing the desired performance. Such correction or substitution constitutes the Client's sole and exclusive remedy for any breach of the undertaking set out in clause 8.1.

8.3    The Supplier:
(a)    does not warrant that:
(i)    the Client's use of the Services will be uninterrupted or error-free; 
(ii)    the Services, Documentation and/or the information obtained by the Client through the Services will meet the Client's requirements; or the Software or the Services will be free from Vulnerabilities.
(iii)    the Services will detect, prevent, respond to or mitigate all threats, attacks, breaches, malware, malicious code, unauthorised access or other security incidents affecting any Tenant, Microsoft 365 identity, session, mailbox, file, application, configuration or Customer Client End User account, and the Client acknowledges that no security product can provide absolute protection.
(b)    is not responsible for any delays, delivery failures, or any other loss or damage resulting from the transfer of data over communications networks and facilities, including the internet, and the Client acknowledges that the Services and Documentation may be subject to limitations, delays and other problems inherent in the use of such communications facilities.

8.4    The Client agrees and acknowledges that whilst the Supplier shall use reasonable endeavours, including the use of industry-standard tools to check that the Services delivered to the Client by the Supplier are free from all known Viruses, the Client hereby acknowledges and agrees that the Supplier does not and cannot control all risks, including hacking and/or security breaches, associated with use of the Services. As such, the Supplier disclaims any and all liability resulting from or related to such events.

8.5    The Supplier shall not be liable for any misuse of the Services by the Client which results in a security breach for the Client, Tenant or any End User.

8.6    The Supplier will not be liable for any alterations to the Microsoft Security Policies made by the Client, End User or any third party that reverse or otherwise affect changes made to that policy by the Supplier in connection with Services.

8.7    This Agreement shall not prevent the Supplier from entering into similar agreements with third parties, or from independently developing, using, selling or licensing documentation, products and/or services which are similar to those provided under this Agreement.

8.8    The Supplier warrants that it has and will maintain all necessary licences, consents, and permissions necessary for the performance of its obligations under this Agreement.

8.9    The Supplier reserves the right at any time to make any improvement, substitution or modification in the design, manufacture or configuration of the Services provided that any such improvement, substitution or modification shall not result in any material change in the functionality or performance of the Services.

8.10    Subject to giving written notice to the Client, the Supplier reserves the right to make any changes to the Documentation and/or the Services which are required to conform with any applicable safety, regulatory or other statutory requirement which do not materially adversely affect the quality or performance of the Services.

8.11    The Client acknowledges that any Beta Features are provided on an "as is" and "as available" basis, and may be modified, suspended or discontinued by the Supplier at any time in its sole discretion. The Supplier makes no representations or warranties as to the performance, quality or functionality of Beta Features and the Supplier does not guarantee that Beta Services will be generally available, uninterrupted or error-free. To the extent permitted by law, the Supplier disclaims all warranties for Beta Features, including any implied warranties of merchantability, satisfactory quality or fitness for a particular purpose. Any pricing applicable to a Beta Feature (including any free or promotional pricing during a Ramp Period) is provided for the relevant period only and does not constitute or imply any commitment as to future commercial pricing or continued availability. No User Subscription, fee or other commitment under this Agreement is contingent upon the delivery, continued provision or future functionality of any Beta Feature.

9.    CLIENT'S OBLIGATIONS

9.1    The Client shall:
(a)    provide the Supplier upon request with:
(i)    all necessary co-operation in relation to this Agreement; 
(ii)    all necessary access to such information as may be required by the Supplier and ensure that such information is accurate and complete; and
(iii)    all necessary access to the Client and/or End User and Tenants;
in order to provide the Services;
(b)    to the extent that the Supplier requires access to the Client's premises to perform the Services, provide such access, upon request, during Normal Business Hours (or such other hours as the parties agree in advance) and provide a suitable work environment to enable the Supplier to perform such Services;
(c)    remain solely responsible for securing and backing up its data. The Supplier is not responsible or liable for the deletion of or failure to store any Client Data including but not limited to any Tenant or End User data and other communications maintained or transmitted through the use of the Services;
(d)    be solely responsible for any content that it loads into or creates within the Services;
(e)    without affecting its other obligations under this Agreement, comply with all applicable laws and regulations with respect to its activities under this Agreement;
(f)    carry out all other Client responsibilities set out in this Agreement in a timely and efficient manner. In the event of any delays in the Client's provision of such assistance as agreed by the parties, the Supplier may adjust any agreed timetable or delivery schedule as reasonably necessary;
(g)    appoint an authorised representative in respect of the Services to be performed under each Order Form, such person as identified in the Order Form. The authorised representative shall have authority to contractually bind the Client on all matters relating to the relevant Services; 
(h)    comply with the Supplier's policies as notified from time to time; 
(i)    ensure its (or its affiliates’, where applicable) employees, agents, suppliers, third parties or subcontractors use the Services and the Documentation in accordance with the terms and conditions of this Agreement and shall be responsible for and fully indemnify the Supplier for any of its affiliates or employees' or agents', third parties', suppliers' or subcontractors' breach of this Agreement;
(j)    obtain and shall maintain all necessary licences, consents, and permissions necessary for the Supplier, its contractors and agents to perform their obligations under this Agreement, including without limitation the Services; 
(k)    ensure that its network and systems comply with the relevant specifications provided by the Supplier from time to time; 
(l)    remain solely responsible for the preparation, content, accuracy and review of the output prepared or resulting from the use of the Services; and
(m)    be, to the extent permitted by law and except as otherwise expressly provided in this Agreement, solely responsible for procuring, maintaining and securing its network connections and telecommunications links from its systems to the Supplier's data centres, and all problems, conditions, delays, delivery failures and all other loss or damage arising from or relating to the Client's network connections or telecommunications links or caused by the internet.

9.2    The Client agrees and acknowledges that any Microsoft software, services and application programming interfaces (including Microsoft Graph) used in or for the provision of the Services are provided and controlled by Microsoft and are subject to change, throttling, deprecation, restriction, modification or discontinuation by Microsoft, and that any such change may affect, degrade or interrupt the Services. The Supplier has no control over the impact of such changes and shall have no liability for the acts or omissions of Microsoft affecting the provision of the Services under this Agreement or in respect of any breach of any applicable law by Microsoft.

9.3    The Client acknowledges that: 
(a)    the Supplier's Copilot Readiness Assessment, Copilot Manager, and other reporting and assessment features of the Services assess Microsoft 365 technical posture, data governance, security configuration, and adoption metrics only, and do not constitute legal advice, regulatory compliance advice or a determination of any AI system's classification under AI Legislation; 
(b)    the Client is solely responsible for determining whether its use of AI tools (whether or not managed through the Services) is compliant with applicable AI Legislation; and 
(c)    the scope of the Services does not extend to AI tools used by the Client's employees or End Users outside the monitored Microsoft 365 environment, including unsanctioned or consumer-grade AI tools, and the Supplier shall have no liability arising from such use.

9.4    Where the Client provides Managed Services that incorporate the Services to its End Users, the Client:
(a)    shall be solely responsible for the delivery, quality and results of the Managed Services, including all support, incident triage, customer service, training, account management, billing, marketing and distribution activities;
(b)    shall not (i) make any representation or warranty in respect of the Services, the Software or the Documentation other than those expressly authorised by the Supplier in writing, (ii) hold itself out as the agent, representative, distributor or developer of the Supplier or of the Services, or (iii) cause to be ambiguous the relationship between the Client and the Supplier or the source or origin of the Services; and
(c)    shall indemnify and hold the Supplier harmless against any third-party claim arising out of any representation, warranty, commitment, undertaking, statement or communication by the Client to any End User that exceeds, contradicts or is otherwise inconsistent with the terms of this Agreement or the Documentation.

10.    CHARGES AND PAYMENT

10.1    The Client shall pay the Fees in accordance with this clause 10 and as set out in the applicable Order Form. The applicable Billing Metric, billing frequency, term, unit price, quantity and any minimum volume commitment for each Service SKU shall be as specified in the applicable Order Form, subject to any changes in quantities, licences, subscriptions or commitments made in accordance with this Agreement. Where an Order Form specifies that per-End-User pricing applies to a particular Tenant, the Subscription Fees for that Tenant may include per-End-User charges in addition to, or in place of, fixed per-Tenant pricing. Any such charges shall apply only to the Tenant(s), usage tier(s) or End User thresholds described in the applicable Order Form. Where the Order Form specifies one or more Ramp Periods (including any free, discounted or promotional pricing), the Fees payable during each such period shall be as set out in the Order Form. Upon expiry of the final Ramp Period, the Fees shall automatically adjust to the full subscription rates specified in the Order Form without further notice or amendment, and such rates shall apply for the Initial Subscription Term and any Renewal Periods, subject to any adjustments permitted under this Agreement. 10.5    Unless otherwise set out in the Order Form, the Supplier shall bill the Client for the Fees monthly in advance on or around the first day of each month. For the avoidance of doubt, any pro-rated Fees for Additional Subscriptions or additional Billable End User licences added during a monthly billing period may be billed in arrears on the Client’s next monthly invoice, and any reductions in Billable End User licences shall be reflected from the applicable effective date of reduction in accordance with clause 4.4(b).

10.6    Unless otherwise set out in the Order Form, the Client must pay the Subscription Fees by direct debit. The Client shall provide to the Supplier valid, up-to-date and complete credit/debit card details and any other relevant valid, up-to-date billing details requested by the Supplier and the Client hereby authorises the Supplier to bill such credit/debit card for payment of the Subscription Fees and any additional fees.

10.7    For any additional fees the Client shall pay each invoice or bill submitted to it by the Supplier either: (a) within 14 days of receipt to a bank account nominated in writing by the Supplier from time to time; or (b) as per Client’s then-current payment arrangements.

10.8    The Client shall promptly provide the Supplier with complete and accurate billing and contact information and any changes to such information.

10.9    If the Supplier has not received payment within 14 days after the due date:
(a)    the Supplier may disable the Client's password, account and access to all or part of the Services and the Supplier shall be under no obligation to provide any or all of the Services while the invoice or bill concerned remains unpaid; and
(b)    interest shall accrue on a daily basis on such due amounts at an annual rate equal to 4% over the then current base lending rate of the Supplier's bankers in the UK from time to time, commencing on the due date and continuing until fully paid, whether before or after judgment.

10.10    All amounts and fees stated or referred to in this Agreement:
(a)    shall be payable in the currency specified in the Order Form, unless otherwise agreed;
(b)    are non-cancellable and non-refundable;
(c)    are exclusive of value added tax or other sales tax, which shall be added to the Supplier's invoice or bill at the appropriate rate.

10.11    The Supplier may increase the Fees relating to the Services in the following circumstances:
(a)    on an annual basis, with effect from each anniversary of the Effective Date in line with the percentage increase in the Retail Prices Index in the preceding twelve (12) month period; 
(b)    at any time, in line with any increases imposed upon the Supplier by third party suppliers related to the Services; 
(c)    at any time to reflect any increase in the Fees due to foreign exchange fluctuations; and
(d)    annually after each anniversary of the Effective Date be entitled to increase the Fees upon 90 days' prior notice to the Client and the Order Form shall be deemed to have been amended accordingly.

10.12    If the Supplier does not receive written notice of an objection to the amendment in Fees within thirty (30) days, the Client is deemed to have agreed to the amendment to the Fees.

10.13    If the Client is required by any law or regulation to make any deduction on account of tax including but not limited to withholding tax or otherwise on any sum payable under this Agreement, the Fees payable shall be increased by the amount of such tax to ensure that the Supplier receives a sum equal to the amount to be paid under the applicable Order Form.

11.    PROPRIETARY RIGHTS

11.1    The Client acknowledges and agrees that the Supplier and/or its licensors own all Intellectual Property Rights in the Software, the Services and the Documentation.

11.2    As part of the Services, the Supplier may collect, access, use, process, transmit, or store System Data (i) to provide the Services; (ii) for research and development; (iii) for product and Services improvement; and (iv) to create Statistical Data. The Supplier owns all rights, title, and interest in and to the Reports, Statistical Data, and System Data.

11.3    The Supplier may evaluate and process System Data and Statistical Data (including those derived from Client Data, providing they contain no Personal Data), in an aggregated and anonymous manner (such data, the "Aggregate Data"). The Supplier may use and share such Aggregate Data freely, including to improve the Services, develop new products, understand product trends, and generally for any business purpose. The Supplier retains all Intellectual Property Rights in the Aggregate Data.

11.4    If the Client or any End User provides the Supplier with any suggestion, idea, comment, recommendation or other feedback relating to the Services, the Software, the Documentation or the Supplier's business, whether written or oral (collectively, "Feedback"), the Supplier may, without restriction or obligation, use, reproduce, modify, license, distribute and incorporate that Feedback into the Services or any other product or service of the Supplier. All Intellectual Property Rights in such Feedback shall vest in the Supplier on creation; to the extent any such rights do not vest automatically, the Client hereby assigns and shall procure the assignment to the Supplier of all such rights with full title guarantee.

12.    CONFIDENTIALITY

12.1    Each party may be given access to Confidential Information from the other party in order to perform its obligations under this Agreement. A party's Confidential Information shall not be deemed to include information that:
(a)    is or becomes publicly known other than through any act or omission of the receiving party;
(b)    was in the other party's lawful possession before the disclosure;
(c)    is lawfully disclosed to the receiving party by a third party without restriction on disclosure; or
(d)    is independently developed by the receiving party, which independent development can be shown by written evidence.

12.2    Subject to clause 12.3, each party shall hold the other's Confidential Information in confidence and not make the other's Confidential Information available to any third party, or use the other's Confidential Information for any purpose other than the implementation of this Agreement.

12.3    A party may disclose Confidential Information to the extent such Confidential Information is required to be disclosed by law, by any governmental or other regulatory authority or by a court or other authority of competent jurisdiction, provided that, to the extent it is legally permitted to do so, it gives the other party as much notice of such disclosure as possible and, where notice of disclosure is not prohibited and is given in accordance with this clause 12.3, it takes into account the reasonable requests of the other party in relation to the content of such disclosure.

12.4    The Client acknowledges that details of the Services, any Documentation (where such Documentation is not publicly available), and the results of any performance tests of the Services, constitute the Supplier's Confidential Information.

12.5    The Supplier acknowledges that the Client Data is the Confidential Information of the Client. The Client accepts that the Supplier may create and use aggregated, redacted, and/or anonymised forms of the Client's Data and/or Confidential Information obtained whilst providing the Services to the Client, which do not disclose any of its Confidential Information to a third party.

12.6    No party shall make, or permit any person to make, any public announcement concerning this Agreement without the prior written consent of the other parties (such consent not to be unreasonably withheld or delayed), except as required by law, any governmental or regulatory authority (including, without limitation, any relevant securities exchange), any court or other authority of competent jurisdiction.

12.7    The above provisions of this clause 12 shall survive for 3 years following the termination of this Agreement.

13.    INDEMNITY

13.1    The Client shall defend, indemnify and hold harmless the Supplier against any claims, actions, proceedings, losses, damages, expenses and costs (including without limitation court costs and reasonable legal fees) arising out of or in connection with the Client's, the End User's or where applicable, its affiliates’, employees’, agents’, suppliers’, third parties’ or subcontractors’, use of the Services and/or Documentation, provided that:
(a)    the Client is given notice of any such claim;
(b)    the Supplier provides reasonable co-operation to the Client in the defence and settlement of such claim, at the Client's expense; and
(c)    the Client shall not settle any such claim without the prior written consent of the Supplier, such consent not to be unreasonably withheld or delayed, except where the settlement includes only the payment of money and contains no admission of fault or liability on the part of the Supplier, and provides for a full and unconditional release of the Supplier.

13.2    The Supplier shall defend the Client, its officers, directors and employees against any claim that the Client's use of the Services or Documentation in accordance with this Agreement infringes the Intellectual Property Rights of any third party, and shall indemnify the Client for any amounts awarded against the Client in judgment or settlement of such claims, provided that:
(a)    the Supplier is given notice of any such claim;
(b)    the Client does not make any admission, or otherwise attempt to compromise or settle the claim and provides reasonable co-operation to the Supplier in the defence and settlement of such claim, at the Supplier's expense; and
(c)    the Supplier is given sole authority to defend or settle the claim.
13.3    In the defence or settlement of any claim, the Supplier may procure the right for the Client to continue using the Services, replace or modify the Services so that they become non-infringing or, if such remedies are not reasonably available, the Supplier may terminate this Agreement on 2 Business Days' notice to the Client without any additional liability or obligation to pay liquidated damages or other additional costs to the Client.

13.4    The Supplier, its employees, agents and sub-contractors shall not be liable to the Client to the extent that the alleged infringement is based on:
(a)    a modification of the Services or Documentation by anyone other than the Supplier; or
(b)    the Client's use of the Services or Documentation in a manner contrary to the instructions given to the Client by the Supplier or outside the scope of this Agreement; or
(c)    the Client's use of the Services or Documentation after notice of the alleged or actual infringement from the Supplier or any appropriate authority; or
(d)    the Client Data, including any data, content or material provided to, or processed through, the Services by the Client or any End User.

13.5    The foregoing and clause 14.3(b) state the Client's sole and exclusive remedy, and the Supplier's (including the Supplier's employees', agents' and sub-contractors') entire liability, for infringement of any patent, copyright, trade mark, database right or right of confidentiality.

14.    LIMITATION OF LIABILITY

14.1    Except as expressly and specifically provided in this Agreement: (a) the Client assumes sole responsibility for results obtained from the use of the Services and the Documentation by the Client and/or its End User, and for conclusions drawn from such use. The Supplier shall have no liability for any damage caused by errors or omissions in any information, instructions or scripts provided to the Supplier by the Client in connection with the Services, or any actions taken by the Supplier at the Client's direction; (b) all warranties, representations, conditions and all other terms of any kind whatsoever implied by statute or common law are, to the fullest extent permitted by applicable law, excluded from this Agreement; and (c) the Services and the Documentation are provided to the Client on an "as is" basis.

14.2    Nothing in this Agreement excludes the liability of the Supplier: (a) for death or personal injury caused by the Supplier's negligence; (b) for fraud or fraudulent misrepresentation; or (c) for any other liability which cannot lawfully be excluded or limited.

14.3    Subject to clause 14.1 and clause 14.2:

(a)    the Supplier shall not be liable whether in tort (including for negligence or breach of statutory duty), contract, misrepresentation, restitution or otherwise for any loss of profits, loss of business, depletion of goodwill and/or similar losses or loss or corruption of data or information, or pure economic loss (in each case whether direct or indirect), or for any special, indirect or consequential loss; and

(b)    the Supplier's total aggregate liability in contract, (including in respect of the indemnity at clause 13.2), tort (including negligence or breach of statutory duty), misrepresentation, restitution or otherwise, arising in connection with this Agreement shall, in respect of all causes of action arising in any calendar year, not exceed the total Fees paid or payable for the User Subscriptions in such calendar year. 

15.    TERM AND TERMINATION

15.1    This Agreement shall commence on the Effective Date and shall continue through any Ramp Period (if applicable) and the Initial Subscription Term. The Initial Subscription Term shall commence on the date the full subscription pricing takes effect, as set out in the Order Form. Thereafter, this Agreement shall automatically renew for successive periods of the same length as the Initial Subscription Term (each a "Renewal Period"), unless: 
(a)    either party notifies the other party of termination, in writing, at least 60 days before the end of the Initial Subscription Term or any Renewal Period, in which case this Agreement shall terminate upon the expiry of the applicable Initial Subscription Term or Renewal Period; or
(b)    otherwise terminated in accordance with the provisions of this Agreement;
and the Initial Subscription Term together with any subsequent Renewal Periods shall constitute the Subscription Term.

15.2    Without affecting any other right or remedy available to it, either party may terminate this Agreement with immediate effect by giving written notice to the other party if:
(a)    the other party fails to pay any amount due under this Agreement on the due date for payment and following a reminder from the Supplier with regard to the overdue amount, remains in default not less than 30 days after being notified in writing to make such payment;
(b)    the other party commits a material breach of any other term of this Agreement which breach is irremediable or (if such breach is remediable) fails to remedy that breach within a period of 30 days after being notified in writing to do so; 
(c)    the other party is subject to an Insolvency Event.

15.3    On termination of this Agreement for any reason:
(a)    all licences granted under this Agreement shall immediately terminate and the Client shall immediately cease all use of the Services and/or the Documentation; 
(b)    each party shall return and make no further use of any equipment, property, Documentation and other items (and all copies of them) belonging to the other party, save that: (i) the Supplier may retain copies of System Data and Statistical Data in accordance with clause 11.2; (ii) the Supplier may retain any record or material that the Supplier is required by applicable law, regulation or industry standard to retain; and (iii) each party may retain copies of materials stored on routine backup systems that are not actively processed, until those backups are overwritten or deleted in accordance with its standard backup retention policy;
(c)    the Supplier may destroy or otherwise dispose of any Client Data in its possession, unless the Supplier receives, no later than 10 days after the effective date of the termination of this Agreement, a written request for the delivery to the Client of the then most recent back-up of the Client Data. At the Client's cost, the Supplier shall use reasonable commercial endeavours to deliver the back-up to the Client within 30 days of its receipt of such a written request, provided that the Client has, at that time, paid all fees and charges outstanding at and resulting from termination (whether or not due at the date of termination). The Client shall pay all reasonable expenses incurred by the Supplier in returning or disposing of Client Data; and
(d)    any rights, remedies, obligations or liabilities of the parties that have accrued up to the date of termination shall not be affected or prejudiced; and
(e)    in respect of any Security Services, the Client shall, within thirty (30) days of the effective date of termination, remove the Supplier's enterprise application registration and revoke all Microsoft Graph consents granted in connection with the Services across all in-scope Tenants. The Supplier reserves the right to revoke its own service principal access to such Tenants on or after the effective date of termination; and
(f)    the following clauses shall survive termination of this Agreement: clauses 1 (Interpretation), 2.4 (Restrictions), 6 (Client Data), 9.3 (AI scope limitation acknowledgements) and any separate DPA, 11 (Proprietary rights, including in respect of System Data and Statistical Data), 12 (Confidentiality, subject to clause 12.7), 13 (Indemnity), 14 (Limitation of liability), 15.3 (Effects of termination), 18 (Conflict), 20 to 27 (Waiver, Rights and Remedies, Severance, Entire Agreement, Assignment, No partnership or agency, Third party rights, Notices), 28 (Dispute Resolution), 29 (Governing law), 30 (Jurisdiction) and Schedule 1 (Service SKU Terms), together with any other provision which by its nature is intended to survive.

15.4    Where the Supplier terminates this Agreement under clause 15.2(a) (non-payment) or clause 15.2(b) (material breach by the Client), or where the Client purports to terminate this Agreement other than in accordance with its terms during an Initial Subscription Term or Renewal Period, all Fees payable for the remainder of the then-current Initial Subscription Term or Renewal Period shall accelerate and become immediately due and payable, without prejudice to any other right or remedy of the Supplier.

16.    SUBCONTRACTING

Save as set out in clause 6, the Supplier may subcontract any of its obligations under this Agreement. The Supplier shall remain responsible to the Client for the performance of any subcontracted obligations.

17.    FORCE MAJEURE

17.1    The Supplier shall have no liability to the Client under this Agreement if it is prevented from or delayed in performing its obligations under this Agreement, or from carrying on its business, by acts, events, omissions or accidents beyond its reasonable control, including, without limitation, strikes, lock-outs or other industrial disputes (whether involving the workforce of the Supplier or any other party), failure of a utility service or transport or telecommunications network, act of God, pandemics or epidemics, war, riot, civil commotion, malicious damage, compliance with any law or governmental order, rule, regulation or direction, accident, breakdown of plant or machinery, fire, flood, storm or default of suppliers or sub-contractors, provided that the Client is notified of such an event and its expected duration.

17.2    If the period of delay or non-performance pursuant to this clause 17 continues for four (4) weeks or more, the party not affected may terminate this Agreement by giving fourteen (14) days' written notice to the other party.

18.    CONFLICT

18.1    If there is an inconsistency between any of the provisions in the main body of this Agreement and the Order Form (including any changes to the Order Form), the following order of precedence shall apply (in decreasing order) to the extent of such conflict or inconsistency:
(a)    Order Form;
(b)    the clauses in this Agreement.

18.2    The Order Form shall set out the specific Service SKU(s) purchased, applicable usage limits (including per-Tenant or per-End-User metrics), and associated Fees. In the event of conflict, the Order Form shall prevail.

19.    VARIATION

19.1    Supplier Updates to T&Cs
(a)    Clients governed by a prior version of these T&Cs (“Existing T&Cs”) shall remain on such Existing T&Cs unless they execute a new Order Form referencing these T&Cs or otherwise accept these T&Cs in writing.
(b)    The Supplier may update these T&Cs at any time. For material changes, the Supplier shall give at least thirty (30) days' written notice to the Client (the "Notice Period").
(c)    If the Client objects in writing before expiry of the Notice Period, the Existing T&Cs shall continue to apply until the end of the then-current Subscription Term. Continued use of the Services (without objection) after the Notice Period constitutes acceptance of these T&Cs by the Client.

19.2    Client Amendments
Non-material amendments (such as changes to User Subscription quantities) may be made by self-service or email or other written correspondence, effective upon the Supplier’s written acknowledgment.
All other amendments must be agreed in writing and signed by both parties. Client amendments shall prevail only over the specific provisions they modify.

20.    WAIVER

No failure or delay by a party to exercise any right or remedy under this Agreement or by law shall constitute a waiver of that or any other right or remedy, nor prevent its further exercise.

21.    RIGHTS AND REMEDIES

Except as expressly provided in this Agreement, the rights and remedies provided under this Agreement are in addition to, and not exclusive of, any rights or remedies provided by law.

22.    SEVERANCE

If any provision of this Agreement is or becomes invalid, illegal or unenforceable, it shall be deemed deleted without affecting the validity of the remaining provisions. The parties shall negotiate in good faith to agree a replacement provision achieving the intended commercial result.

23.    ENTIRE AGREEMENT

This Agreement constitutes the entire agreement between the parties and supersedes all previous agreements, representations and understandings relating to its subject matter. Each party acknowledges that in entering into this Agreement it does not rely on any statement, representation or warranty not set out in this Agreement.

24.    ASSIGNMENT

24.1    The Client shall not, without the prior written consent of the Supplier, assign, transfer, charge, sub-contract or deal in any other manner with all or any of its rights or obligations under this Agreement.

24.2    The Supplier may at any time assign, transfer, charge, sub-contract or deal in any other manner with all or any of its rights or obligations under this Agreement.

25.    NO PARTNERSHIP OR AGENCY

Nothing in this Agreement is intended to or shall operate to create a partnership between the parties, or authorise either party to act as agent for the other, and neither party shall have the authority to act in the name or on behalf of or otherwise to bind the other in any way (including, but not limited to, the making of any representation or warranty, the assumption of any obligation or liability and the exercise of any right or power).

26.    THIRD PARTY RIGHTS

This Agreement does not confer any rights on any person or party (other than the parties to this Agreement and, where applicable, their successors and permitted assigns) pursuant to the Contracts (Rights of Third Parties) Act 1999.

27.    NOTICES

27.1    Any notice required to be given under this Agreement shall be in writing and shall be emailed, delivered by hand or sent by pre-paid first-class post or recorded delivery post to the other party at its address set out in the Order Form, or such other address as may have been notified by that party for such purposes. Any notice sent to the Supplier by email shall be sent to notices@inforcer.com, or to such other email address as the Supplier may notify to the Client from time to time.

27.2    A notice delivered by hand shall be deemed to have been received when delivered (or if delivery is not in business hours, at 9am on the first Business Day following delivery). A correctly addressed notice sent by pre-paid first-class post or recorded delivery post shall be deemed to have been received at the time at which it would have been delivered in the normal course of post. A notice sent by email shall be deemed to have been received at the time of transmission (as shown by the timed printout obtained by the sender).

28.    DISPUTE RESOLUTION

28.1    If a dispute arises under this Agreement, a party must first give written notice describing the dispute to the other party.

28.2    The parties shall attempt to resolve any dispute through good faith negotiations between designated senior representatives for thirty (30) calendar days from receipt of notice. If the dispute is not resolved within that period, either party may proceed with any available legal remedy.

29.    GOVERNING LAW

This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the law of England and Wales.

30.    JURISDICTION

Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Agreement or its subject matter or formation (including non-contractual disputes or claims).

31.    COMPLIANCE WITH LAWS; ANTI-CORRUPTION

31.1    Each party agrees to comply with all laws applicable to the actions and obligations contemplated by this Agreement, including those (i) directed at corrupt acts and (ii) relating to equality, diversity, and the prevention of harassment, including the Worker Protection (Amendment of Equality Act 2010) Act 2023, as applicable. Each party represents and warrants that, during the term of this Agreement, neither party nor any of its officers, employees, agents, representatives, contractors, intermediaries, or any other person or entity acting on its behalf has taken or will take any action, directly or indirectly, that contravenes (a) the United States Foreign Corrupt Practices Act 1977, (b) the United Kingdom Bribery Act 2010, or (c) any other applicable anti-bribery laws or regulations anywhere in the world.

32.    EXPORT COMPLIANCE AND SANCTIONS

32.1    Each party shall comply with all applicable export control, trade sanctions and embargo laws and regulations in connection with the performance and receipt of the Services, including (without limitation) those administered by the United Kingdom, the United States, the European Union and its member states, the United Nations, and any other jurisdiction in which a Party is established or in which the Services are provided or used (together, the "Applicable Trade Laws").

32.2    The Client shall not, and shall procure that its End Users shall not, directly or indirectly, access, use, export, re-export, transfer or release the Services, or any underlying software, technology, data or output, to or from: (i) any country, region or territory that is the subject of comprehensive sanctions or embargoes under Applicable Trade Laws; or (ii) any person or entity that is the subject of sanctions or asset-freezing measures under Applicable Trade Laws, or that is owned or controlled by such a person or entity.

32.3    Each party represents and warrants that it is not, and is not owned or controlled by any person that is, the subject of sanctions or asset-freezing measures under Applicable Trade Laws, and that it will promptly notify the other party if it becomes the subject of, or reasonably anticipates becoming the subject of, any such measures.

32.4    The Client shall be solely responsible for determining whether any use, configuration or onward transfer of the Services by the Client or its End Users requires a licence, authorisation or notification under Applicable Trade Laws, and for obtaining and maintaining any such licence, authorisation or notification.

32.5    Without prejudice to any other right or remedy, the Supplier may suspend or terminate the Services (in whole or in part) on written notice with immediate effect where the Supplier reasonably determines that continued provision of the Services would, or would be reasonably likely to, cause the Supplier to breach Applicable Trade Laws.

This Agreement has been entered into on the Effective Date.

SCHEDULE 1 - SERVICE SKU TERMS

The following terms apply to the Service SKUs specified below, where purchased by the Client under an Order Form.

Part 1 -Tenant Assessment Licence

The Tenant Assessment Licence is an assessment-only tool and excludes configuration, remediation, policy deployment or other management actions. The Supplier may implement reasonable technical controls to enforce this distinction. Unless otherwise stated in the applicable Order Form, the Tenant Assessment Licence is an unlimited-use subscription and is not subject to usage limits.

Part 2 – Security Services

Where the Services include identity threat detection and response, monitoring of Microsoft 365 environments, or other security functionality (the “Security Services”), the following terms apply:

1.    Authorisation and Response Actions

The Client authorises the Supplier (and any Response Action automation operating on the Client’s behalf within the Services) to access in-scope Tenants via Microsoft Graph and to perform Response Actions in accordance with the configuration set, accepted or maintained by the Client through the Services.

The Client is solely responsible for the selection, configuration, scope, content and effect of any auto-response rules, playbooks, or other Response Action settings enabled through the Services. The Supplier may provide default settings and templates, but the configuration in effect at any time is the Client’s.

The Client expressly authorises the Supplier to execute Response Actions in accordance with the configuration in effect at any given time. The Supplier shall use reasonable skill and care in the execution of Response Actions but does not warrant any particular outcome, effect or absence of business disruption arising from a Response Action. The Supplier shall have no liability for any operational, productivity, communications or other loss arising from the execution of any Response Action that is consistent with the configuration the Client has selected, accepted, allowed to default or failed to disable; and the Client shall be solely responsible for any consequential communications with affected End Users or Customer Client End Users and for the reversal (where technically feasible) of any Response Action.

2.    Microsoft Graph Permissions and Consents

The Client warrants that it has the authority to grant, and shall maintain, all administrator consents and Microsoft Graph permissions required for the Supplier’s enterprise application or service principal to provide the Security Services to in-scope Tenants, including any conditional access carve-outs reasonably required by the Supplier.

The Client acknowledges that revocation of Microsoft Graph consent, removal of the Supplier’s service principal, restriction of conditional access or downgrade of the relevant Microsoft 365 licensing or audit-log retention may cause the Security Services to operate in a degraded manner or cease to operate, and that any such degradation shall not constitute a breach of this Agreement by the Supplier.

3.    End User Communications

The Client is solely responsible for the delivery of services and support to, and for any incident communications with, its End Users and Customer Client End Users. The Client shall ensure that its End Users and Customer Client End Users are appropriately informed (including, where applicable, in accordance with Article 14 of the UK GDPR and equivalent legislation) that the Security Services may read Microsoft 365 audit, sign-in, message and configuration metadata and that Response Actions may be taken in respect of Customer Client End User accounts.

4.    AI Features

The Client acknowledges that certain Security Services features may use artificial intelligence or machine learning models (including Azure Foundry) to analyse threats, classify near-miss incidents, detect behavioural patterns across Tenants and assess false positives (“AI Features”). The Client may enable AI Features through the Services configuration. The Supplier shall maintain transparency documentation regarding AI Features.

Where AI Features are enabled: 
(a)    on initial activation of the Security Services for a Tenant, the Services will access and analyse historical Microsoft 365 log data for up to six (6) months prior to activation to establish baseline threat profiles; 
(b)    automated processing of near-miss incidents, threat patterns and false positives may result in changes to detection rules and alert thresholds; and 
(c)    the Client is responsible for determining whether the use of AI Features complies with applicable AI Legislation and Data Protection Legislation, including any obligation to inform Customer Client End Users of automated decision-making.

5.    Cooperation with Authorities

Without limiting any obligation of the Supplier under applicable law, the Supplier may, in its reasonable discretion, report to and cooperate with law-enforcement, regulatory or other competent authorities, and with industry threat-intelligence partners and computer security incident response teams, in the investigation of: (a) any actual or suspected criminal activity that threatens the safety or fundamental rights of any natural person (including child sexual abuse material or terrorist activity); (b) any actual or suspected serious cybercrime, intrusion or fraud affecting the Services, the Supplier’s infrastructure or any Tenant; or (c) any matter that the Supplier is required by applicable law to disclose. The Supplier shall, where lawful and consistent with the integrity of any investigation, provide the Client with notice of any such disclosure and shall limit the disclosure to what is reasonably necessary.

6.    Logging and Audit Prerequisites

The Client shall maintain throughout the Subscription Term: (a) all Microsoft 365 audit and sign-in log retention settings purchased (including, where applicable, enablement of the unified audit log, Microsoft Entra ID Premium P1 or P2 licensing for in-scope identities, and minimum log-retention periods); (b) any conditional access carve-outs reasonably required for the Supplier’s enterprise application or service principal to operate; and (c) administrator notification arrangements sufficient to allow the Client to receive and respond to alerts generated by the Services. Any failure to maintain these prerequisites that materially degrades the Services shall not constitute a breach of this Agreement by the Supplier.

U.S. ADDENDUM TO THE INFORCER CUSTOMER TERMS AND CONDITIONS

Last Modified: July 29, 2026

This U.S. Addendum (“US Addendum”) forms part of the online Customer Terms and Conditions (the “T&Cs”). This US Addendum sets forth specific provisions that apply to Client’s Supplier Contracting Party and that replace or supplement the equivalent provisions noted below.

All capitalized terms not defined in this US Addendum shall have the meaning set forth in the T&Cs. In the event of any conflict between the terms of this US Addendum and the T&Cs, this US Addendum shall prevail. The Parties agree as follows:

Section 1. INTERPRETATION

The definition of “Insolvency Event” is hereby deleted and replaced by the following: 
“Insolvency Event” means (i) a Party becomes insolvent or is generally unable to pay, or fails to pay, its debts as they become due; (ii) a Party files, or has filed against it, a petition for voluntary or involuntary bankruptcy or otherwise becomes subject, voluntarily or involuntarily, to any proceeding under any domestic or foreign bankruptcy or insolvency law, including Title 11 of the United States Code; (iii) a Party makes or seeks to make a general assignment for the benefit of its creditors; or (iv) a Party has appointed a receiver, trustee, custodian, or similar agent by order of any court of competent jurisdiction to take charge of or sell any material portion of its property or business.”
The following definition of “Sensitive Data” is hereby inserted into Section 1 of the T&Cs:
“Sensitive Data” means (i) protected health information as defined in the Health Insurance Portability and Accountability Act, as amended; (ii) payment cardholder information or financial account information, including bank account numbers or other personally identifiable financial information; (iii) social security numbers, driver’s license numbers, or other government identification numbers; (iv) other information subject to any other regulation or protection under specific laws such as the Children's Online Privacy Protection Act or the Gramm-Leach-Bliley Act; (vi) special categories of data enumerated in European Union Regulation 2016/679, Article 9(1) or any successor legislation; or (vii) any data similar to the above protected under applicable laws, rules, or regulations.”

Section 6. CLIENT DATA
The following is hereby inserted as Section 6.4 of the T&Cs:
“6.4 The Client acknowledges and agrees that the Services are not designed to store or process Sensitive Data. Unless otherwise permitted by the applicable Order Form, Client shall not submit, post, or otherwise transfer Sensitive Data to Supplier through the Services. For the avoidance of doubt, Supplier may collect payment and financial account information from Client for the purposes of facilitating payment of applicable fees for the Services.

Section 12. CONFIDENTIALITY. 
The following is hereby inserted as Section 12.9 of the T&Cs:
“12.9 Due to the unique nature of Confidential Information, the Parties agree that there may be no adequate remedy at law for any breach or any unauthorized use or release of any Confidential Information, resulting in irreparable harm to the disclosing Party. Upon any actual or threatened breach, unauthorized use or release of this Section 12, the disclosing Party will be entitled to seek appropriate equitable relief and such remedy shall be in addition to any other remedies the disclosing Party may have under the Agreement or applicable law.

Section 13. INDEMNITY
All references to “United Kingdom” under Section 13 of the T&Cs shall be hereby deemed to refer to the “United States”.

Section 29. GOVERNING LAW
Section 29 of the T&Cs is hereby deleted and replaced with the following: 
“29. GOVERNING LAW
This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of the State of New York, United States, without giving effect to any choice or conflict of law provision or rule.”

Section 30. JURISDICTION
Section 30 of the T&Cs is hereby deleted and replaced with the following:
“30. ARBITRATION
Notwithstanding Section 28 of the T&Cs, any dispute arising under or relating in any way to this Agreement or the breach, termination, enforcement, interpretation, or validity thereof, including the determination of the scope or applicability of this agreement to arbitrate, will be resolved exclusively by final and binding arbitration in New York, New York before one arbitrator in English pursuant to JAMS Comprehensive Arbitration Rules and Procedures, except that either Party may bring a claim related to its intellectual property rights or enforce the confidentiality obligations of this Agreement, or seek temporary and preliminary specific performance or injunctive relief, in any court of competent jurisdiction, without the posting of bond or other security. The non-prevailing Party in any arbitration action or lawsuit arising from or relating to this Agreement will pay the prevailing Party’s reasonable attorneys’ fees, court costs and expenses. In the event of a dispute related to the accuracy of an invoice (“Billing Dispute”), Client will promptly, but in no event later than thirty (30) days following the date of such invoice, notify Supplier in writing of the nature of the Billing Dispute. If no such notice is timely received the invoice is deemed accepted by Client. While the Parties work to resolve the Billing Dispute, all terms and conditions of this Agreement will remain in full force and effect, unless otherwise terminated pursuant to this Agreement.”

Section 33. US GOVERNMENT RIGHTS
The following is hereby inserted as Section 33 in the T&Cs:
“33. US GOVERNMENT RIGHTS
Each of the Documentation and the software components that constitute the Services is a “commercial item” as that term is defined at 48 C.F.R. § 2.101, consisting of “commercial computer software” and “commercial computer software documentation” as such terms are used in 48 C.F.R. § 12.212. Accordingly, if Client is an agency of the US Government or any contractor therefor, Client only receives those rights with respect to the Services and Documentation as are granted to all other end users, in accordance with (a) 48 C.F.R. § 227.7201 through 48 C.F.R. § 227.7204, with respect to the Department of Defense and their contractors, or (b) 48 C.F.R. § 12.212, with respect to all other US Government users and their contractors.”