Paragus fully managed It service Terms

1. How These Service Terms Work

1.1 These Fully Managed Service Terms describe how Paragus delivers the Fully Managed program. They are incorporated by reference into a signed Client Service Agreement, alongside the Paragus Universal Service Terms.

1.2 What is not here. These Service Terms contain no legal or risk-allocation content. Those terms are in the signed Client Service Agreement and the Universal Service Terms, and §3 of the Universal Service Terms governs precedence.

1.3 Amendment. Paragus may amend these Service Terms only as §4.3 of the Client Service Agreement provides.

1.4 Targets, not guarantees. Response figures, onboarding windows and deliverable dates in this document are targets and carry no service-level remedy. §12.4 of the Universal Service Terms applies to all of them.

2. The Program

2.1 Plans. Fully Managed is delivered at the plan levels Paragus publishes from time to time. Client’s SOW states Client’s plan, and §2.2 of Client’s SOW states the services included for Client. That list governs what Paragus owes Client.

Paragus may change the plan levels it offers, and what they include, at any time. §5.1A(g) of the Universal Service Terms applies.

2.2 The dedicated team. Each client is assigned three people:

• an Account Relationship Manager, who owns strategic alignment and the annual IT plan;

• a Network Engineer, who owns proactive maintenance and the security posture; and

• a Client Support Manager, who owns the day-to-day support experience.

All three are included at every plan level.

2.3 Base fee. Client’s base fee reflects the complexity of its environment rather than its size. It may be reassessed each year, and as part of a major project to improve the environment. Where the environment becomes more secure and reliable, the base fee may be reduced to reflect that.

An increase under this Section is made as §5.1A(f) of the Universal Service Terms provides. A reduction takes effect on the date stated in Paragus’s notice and gives rise to no right under §5.1A(c) of those Terms.

3. Supported Environment

3.1 Paragus supports client technology that meets all of the following:

(a) Hardware within the manufacturer’s current support lifecycle, and not declared end-of-life or end-of-support; (b) Operating systems at versions the vendor currently supports and for which security updates are available; (c) Applications at versions the publisher currently supports; (d) Network equipment that is business-class and within the manufacturer’s current support lifecycle; and (e) Configurations that permit Paragus’s management and security tooling to be installed and to function as designed.

3.2 Technology that does not meet Section 3.1 is an unsupported configuration. Paragus will support it on a commercially reasonable basis as a Non-Routine Service, and Sections 7, 8 and 12 of the Universal Service Terms apply to it.

3.3 No product list. This Section defines support by criteria rather than by naming products, so that a change of vendor or version does not require an amendment. Paragus may publish a supported-technology list for convenience; the criteria in Section 3.1 control.

4. How to Reach Us

4.1 Channels. Client may raise a request through:

• the Paragus client portal;

• Client’s private support telephone number;

• live chat with the Paragus team, Monday to Friday, 8:00am to 5:30pm ET, excluding Paragus holidays; or

• any scheduled routine onsite visit or routine office-hour session.

4.2 Help desk hours. Client’s SOW states which applies:

4.2A Paragus holidays. Standard and Expanded Day hours exclude Paragus holidays. Paragus holidays are New Year’s Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Thanksgiving Day and Christmas Day.

4.3 Case assignment. Paragus assigns each case based on urgency, impact and the nature of the issue. Client is not assigned a single named technician, and every Paragus technician has access to documentation of Client’s environment.

5. Response Targets

5.1 Paragus manages to and reports against the following response targets. All figures are business hours within Client’s help desk tier.

5.2 What these measure. A response target is the time to a substantive response. It is not a time to resolution, and no resolution time is committed.

5.3 Rapid Response. Brief requests, being those that need no troubleshooting or that follow defined steps, are handled by a Rapid Response Technician. The response targets in Section 5.1 apply, and no resolution time is committed.

5.3A Rapid Response Plus Users. Every request from a Rapid Response Plus User is handled at Paragus’s highest priority, the Critical target in Section 5.1, whatever its business impact. Client’s SOW states how many Rapid Response Plus Users its plan includes, and additional Rapid Response Plus Users are available at the rate in §4.4 of that Statement of Work. No resolution time is committed.

5.4 Section 1.4 applies. These are targets.

6. Service Escalation Path

6.1 What this Section is for. §4.8(e) of the Universal Service Terms provides that a Notice of Material Breach is not effective unless Client confirms it has exhausted this path. This Section is that path.

6.2 Step 1 – raise it. Client notifies its Account Relationship Manager in writing, or gives written notice to Paragus’s notice address under §20 of the Universal Service Terms, describing the concern and what it wants addressed. Notice given either way starts the period in Section 6.3, whether or not the Account Relationship Manager is available.

6.3 Step 2 – service review. Paragus will convene a service review within ten (10) business days of Client’s notice under Section 6.2, including the Account Relationship Manager and the other members of Client’s dedicated team under Section 2.2, and will give Client a written summary of its findings and the actions it will take within five (5) business days after the review.

6.4 Step 3 – executive review. Where the actions in that written summary do not resolve the concern within thirty (30) calendar days after Client receives it, Client may request an executive review in writing with the Director of Client Strategy. Paragus will convene it within ten (10) business days of the request and will confirm the outcome in writing.

6.5 Deemed completion. Where Paragus does not convene a review within the period stated for that step, that step is deemed complete and Client may proceed to the next step.

6.6 What this path does not affect. This path is a condition only of a termination for cause (§4.8(e) of the Universal Service Terms) and of a proceeding under §7.1(c) of the Client Service Agreement. It does not delay or condition any other right to end the Agreement.

6.7 Individual requests. This Section concerns the overall service relationship. Escalation of an individual support request is an internal operational process and is not part of the Agreement.

7. Non-Routine Services

7.1 What is non-routine. The great majority of day-to-day requests are included in Client’s plan. The following are Non-Routine Services, billed as provided in Section 8:

• supporting or installing non-business applications;

• supporting equipment, software or networks belonging to Client’s employees rather than to Client;

• help desk support for individuals not counted in Client’s SOW;

• major upgrades to Client’s line-of-business applications;

• non-routine onsite visits;

• installation of new network equipment or multi-user software;

• installing a new printer, copier or scanner;

• creation and maintenance of compliance documentation, or written backup and disaster recovery plans;

• audits and assessments requested by Client;

• individual or group training requested by Client;

• recovery from a failed update or other planned maintenance;

• support for technology outside the Supported Environment (Section 3);

• remediation of a cybercrime incident;

• remediation of an issue arising from an unsupported configuration Client elected not to address;

• recovery from a natural disaster or other catastrophic event outside Paragus’s control.

Work outside Client’s help desk hours is billed under Section 8.6, not as a Non-Routine Service.

7.2 Who may request it. Only an Authorized Requester designated under §6.2 of the Universal Service Terms may request Non-Routine Services or Projects. §6.2 of the Universal Service Terms governs Paragus’s reliance on such a request.

7.3 Requests from others. A request for Non-Routine Services from someone who is not an Authorized Requester will be declined and redirected to one, except for containment action under §16 of the Universal Service Terms, which Paragus may take without any request, and the first hour of an after-hours call under Section 8.6(a).

8. Rates and the Retainer

8.1 Standard rate. Non-Routine Services are billed at $185 per hour where Client holds no retainer.

8.2 Retainer. Where Client’s SOW states a retainer, Client pre-purchases a stated number of hours each month at $170 per hour.

(a) Unused hours roll forward, capped at three months’ worth of Client’s monthly hours, and expire oldest first. (b) Rolled-over hours have no cash value and are not refundable. Unused hours expire on termination and may not be applied against any invoice. (c) Work beyond the available balance is billed at the standard rate in Section 8.1. (d) On request, Paragus will provide a statement showing hours used, hours remaining, and hours about to expire.

8.3 Routine onsite and office hours. At the Plus and Premium plans, Client’s plan includes an allowance of half an hour per ten IT Users per month. The Essentials plan carries no included allowance. Beyond the allowance, and at Essentials in every case:

8.4 Workstation deployment. New workstation configuration is priced by plan:

8.5 Response to a 24x7 monitoring alert. At the Premium plan, response to a 24x7 network monitoring alert is included. At the Plus plan it is billed at $225 per hour. It is not available at the Essentials plan, where a network monitoring alert raised outside business hours is actioned on the next business day. This Section concerns network monitoring alerts only. It does not affect any endpoint detection and response or identity threat detection service listed in Client’s SOW as monitored 24x7.

8.6 After-hours work. Work outside Client’s help desk hours under Section 4.2 is billed at $225 per hour, with a one-hour minimum, in either of these cases:

(a) a call or request outside those hours pages a Paragus engineer. The first hour is billed once the engineer is paged, whoever at Client made the call. Work beyond the first hour needs the approval of an Authorized Requester; or

(b) Client asks for work to be scheduled outside those hours, for example to avoid disrupting its business, whether or not the same work would be included if performed during those hours.

After-hours work is billed in addition to, and is not drawn from, any retainer under Section 8.2. This Section does not apply to containment action under §16 of the Universal Service Terms, to response to a network monitoring alert (Section 8.5), or to anything Client’s SOW lists as included outside business hours. Maintenance Paragus itself schedules outside those hours is not billed under this Section, except where Client’s SOW states that it is billed at Client’s plan. A routine request left for the next business day is handled then at no additional charge. Where Client’s help desk hours are All Hours, no work is outside them and this Section does not apply.

8.7 Rate changes. Section 1.3 applies to a change in these rates. A rate change does not affect work already authorized at a stated rate.

9. Onboarding

9.1 Phases. Onboarding runs approximately ninety (90) days, with service normalization at approximately day thirty and the findings review between day sixty (60) and day seventy-five (75).

9.2 Onboarding Completion Date. For the purposes of the Universal Service Terms, the Onboarding Completion Date is the date Paragus holds the findings review with Client under Section 9.3.

9.3 Deliverables. Onboarding includes the following. The checkup, findings review and roadmap are delivered between day sixty (60) and day seventy-five (75) after the Service Commencement Date. Section 1.4 applies.

• a dedicated onboarding team;

• a comprehensive IT infrastructure checkup;

• a findings review; and

• an IT strategy roadmap with key initiatives.

9.4 What the checkup is and is not. The infrastructure checkup is a point-in-time assessment. It is not a forensic examination, a compromise assessment, a threat hunt, or a penetration test, and it does not establish that Client’s environment is free of existing compromise. A compromise assessment is available for a fixed fee of $1,500 (Client’s SOW §5.5), and Section 12.4 applies whether or not Client has one.

9.5 Prior provider overlap. Client is required to maintain its prior provider for at least thirty (30) days after the Service Commencement Date. Where Client does not, Paragus’s onboarding obligations and the deliverables in Section 9.3 are suspended to the extent affected, and the shortfall is recorded under §8 of the Universal Service Terms.

9.6 Credentials and prior access. Paragus rotates administrative credentials and removes the prior provider’s access during onboarding, and Client shall give Paragus the access, information and cooperation it needs to do so. Paragus’s accountability for security outcomes begins when that is complete.

9.7 Detection obligations begin when the tooling reports. Paragus has no monitoring or detection obligation for any system until its tooling has been deployed to that system and is reporting. The date Paragus’s management or security tooling first records the system reporting is that date, and the tooling’s own record is the evidence of it.

9.8 Billing. Billing begins on the Service Commencement Date (§4.1A of the Universal Service Terms). Service start is onboarding start.

9.9 The onboarding record. During onboarding Paragus records, in the Responsibility Matrix: (a) the systems Paragus manages and the systems it backs up, with the retention for each; (b) the agreed maintenance windows; (c) Client’s sites and Authorized Requesters; (d) every person other than Paragus holding administrative or other privileged access to Client’s environment, whether a member of Client’s personnel or a third party, and the access each holds; and (e) the role of each party on each line under Section 14. Paragus keeps the record current as things change. Each change is a new version, and the most recent version is available to Client in the client portal. Client’s signature on a version acknowledges receipt; a version takes effect when Paragus delivers it. The record does not amend Client’s SOW. Client shall tell Paragus promptly if anything in it is wrong.

10. Required Security Measures

10.1 Client shall implement and maintain, and shall permit Paragus to implement and maintain, the following:

(a) Multi-factor authentication on all user accounts with access to Client email or Client data.

(b) Endpoint detection and response tooling on all workstations and servers within scope.

(c) Patching of operating systems and applications on the cadence agreed with Client during onboarding and recorded in the Responsibility Matrix, including the restarts patching requires.

(d) Privileged access control. No standing global or enterprise administrator accounts. Where a user requires elevated permissions, those permissions shall be scoped to the minimum required for the role, and shall be held in an account separate from that user’s day-to-day account where Paragus recommends that separation.

(e) Legacy authentication disabled on Client’s Microsoft 365 or Google tenant.

(f) Supported versions of all hardware, operating systems and applications, per Section 3.

(g) Identity threat detection and response monitoring on Client’s Microsoft 365 or Google tenant.

(h) Advanced email security filtering on all Client mailboxes.

(i) Properly licensed software. Client shall hold a valid license for all software in its environment. Client shall not install or operate unlicensed software, and shall not share, reuse or transfer license keys otherwise than as the publisher permits.

10.2 Where Client declines. §7.2 of the Universal Service Terms applies.

10.3 Changes to this list. Paragus may add to or modify this Section under Section 1.3. §7.3 of the Universal Service Terms governs when a new or modified measure takes effect for Client.

11. Backup

11.1 What Paragus commits to. For each system the onboarding record under Section 9.9 shows Paragus backs up, Paragus will:

(a) configure the backup for that system to the retention period recorded for it;

(b) monitor every scheduled backup job for success or failure; and

(c) act on a failed or missed job by investigating it and taking reasonable steps to correct it, with a target of the next business day. Section 1.4 applies to that target.

Paragus commits to that process, and not to an outcome. No recovery point objective, recovery time objective or time-to-restore is committed, and any such figure appearing in any document is expressly disclaimed. A successful backup job is not a representation that any particular restore will succeed.

11.1A Restore testing. Restore testing is not included in Section 11.1. Paragus will quote it on request. Unless Client buys restore testing, the recoverability of its backups has not been tested by Paragus.

11.2 Backup Effective Date. A system’s Backup Effective Date is the date of the first successful backup of it recorded by Paragus’s backup platform, and that record is the evidence of it. Retention accrues forward from that date. Paragus has no obligation in respect of any recovery point earlier than that date.

11.3 Client-provided backup – minimum standards. Where Client provides its own backup solution, Paragus assesses it during onboarding against the following minimum standards:

(a) retention of not less than ninety (90) days; (b) at least one copy held offsite or in immutable storage; (c) software at a version the vendor currently supports; and (d) alerting on any failed or missed backup job, delivered within twenty-four (24) hours, by email or ticket rather than by dashboard only, to at least one named recipient at Paragus – either a named Paragus individual or a monitored Paragus mailbox Paragus identifies to Client during onboarding. A solution that reports only to a dashboard, or only to a Client-side recipient, does not meet this standard.

There is no one-size-fits-all approach to local backup. The assessment looks at Client’s actual needs and existing solution and makes recommendations, and it checks what Client has against the standards above.

11.4 Alerting does not transfer responsibility. Client-provided backup remains Client’s solution and Client’s responsibility. Paragus’s receipt of an alert under Section 11.3(d) does not make Paragus responsible for the configuration, operation, monitoring, testing or restoration of that solution, does not make Paragus the operator of it, and creates no obligation to act on any individual alert beyond notifying Client. No response time, escalation obligation or restoration commitment attaches to an alert received under Section 11.3(d). Client shall configure and maintain the alerting, and shall notify Paragus if it changes.

11.5 Where a client-provided solution falls short. Paragus will record the specific deficiencies in writing. Client then either remediates, or the shortfall is recorded under §8 of the Universal Service Terms. Where Client declines both, Paragus declines the backup scope only and the remainder of the Agreement is unaffected.

11.6 Prior-provider backup data. Client shall preserve its pre-existing backup data until the later of ninety (90) days after the Backup Effective Date and the end of Client’s own retention requirement. Client shall not decommission it without Paragus’s written confirmation that the replacement is in steady state.

11.7 On-premises equipment. Servers, critical workstations and other on-premises equipment are assessed during onboarding, with recommendations provided in writing.

12. Incident Response

12.1 Authority. §16 of the Universal Service Terms governs Paragus’s authority to contain a suspected incident. This Section covers the operational detail only.

12.2 Rate. Incident investigation, forensics, remediation and recovery are Non-Routine Services at the rate in Section 8.1, except to the extent Client’s plan expressly includes them or §16.5 of the Universal Service Terms provides otherwise.

12.3 Client obligations. §16.6 of the Universal Service Terms applies.

12.4 Pre-existing compromise. Paragus’s obligations do not extend to compromise, persistence or unauthorized access that existed in Client’s environment before the Onboarding Completion Date, whether or not it had been discovered. Section 9.4 applies.

13. Counting Users and Devices

13.1 Three counts. Client’s SOW states each of these at the start of service:

13.2 Exclusions from Email Only Users. Shared mailboxes (for example info@, sales@, support@), resource and room mailboxes, and service accounts.

13.3 Individuals in neither count. An individual with neither a dedicated device nor a Client email address is not counted and is supported on an hourly basis as requested, at the rate in Section 8.1.

13.4 When counts are taken. On or about the fifteenth (15th) day of each month, applying to the following month’s invoice. Counts move in both directions, and each change appears on the invoice.

13.5 Notice Period. The IT Users count is the count used to determine Client’s Notice Period under §4.4 of the Universal Service Terms.

14. Responsibility Matrix and the Conditions Register

14.1 How to read the Matrix. The Matrix states, line by line, the role each party plays, and each line has exactly one owner. Paragus is accountable for a line only where the Matrix shows Paragus as “Owns”, which means Paragus holds the administrative rights, receives the alerts, and is responsible for detecting a problem and driving it to resolution. Under any other role, Paragus does only what that role states. Under “Supports” in particular, Paragus assists on request but does not own the outcome, does not monitor for problems, and is not responsible for detecting a failure. The Matrix defines each role it uses.

14.2 Prepared during onboarding. Paragus prepares the Matrix for Client from the infrastructure checkup and delivers it with the findings review. Each line takes effect when the Matrix is delivered, except that Paragus does not own a line affected by an open condition until the condition is cleared, and the condition is listed under Section 14.3. Until the Matrix is delivered, Paragus’s obligations are those these Service Terms and Client’s SOW state.

14.3 Conditions and Exceptions register. The register is the Documented Exceptions section of the Responsibility Matrix. Paragus opens it at the checkup and maintains it. It lists each open condition and each Documented Exception, the line affected and what is required to clear it. When the condition is cleared, Paragus removes it from the register, and for a Documented Exception that removal is the written confirmation under §8.4 of the Universal Service Terms.

14.4 Conditions found later. A condition Paragus finds after the Matrix is delivered is handled as a Documented Exception under §8 of the Universal Service Terms and listed under Section 14.3. Where Client delays clearing a condition, Paragus does not own the line and the risk of the condition remains with Client.

14.5 Third-party administrative access. Client shall disclose every third party holding administrative access to its environment, and shall notify Paragus before granting any new administrative access. Paragus’s accountability for any function is suspended to the extent a third party holds administrative access Paragus has not been told about.

15. Projects

15.1 What is a project. A request is generally a Project where it will take at least ten (10) hours to complete. Paragus also considers whether it requires coordinating multiple resources, whether other vendors are involved, and whether it warrants a professional project manager.

15.2 Scope and price. Projects are separately scoped, quoted as a fixed fee, and authorized. A signed estimate is its own authorization, and Section 7.2 does not require a separate Authorized Requester request for a project already signed.

16. Licensing and Procurement

16.1 Microsoft 365 and Google. Paragus will become Client’s partner of record and will include license charges on Client’s monthly invoice at the publisher’s standard published rates.

16.2 Pass-through. License charges are pass-through. They are excluded from the Recurring Fee for the purposes of §4.5 and §4.14 of the Universal Service Terms.

16.3 Client’s licensing obligation. §6.3 of the Universal Service Terms applies.

17. AI and Automation Services

17.1 What is included. Where §2.2 of Client’s Statement of Work lists them:

(a) access to a Paragus AI bot, being a configured conversational assistant made available to Client’s users, at the number of bots Client’s plan states;

(b) an annual AI and automation assessment, being a review of Client’s processes and systems identifying candidate uses for AI and automation, delivered in writing; and

(c) an executive AI strategy meeting with Client’s leadership team.

17.2 Configuration and the knowledge base. Paragus will configure each bot in consultation with Client and will connect it to the sources of Client’s own content the parties agree in writing. Client is responsible for the accuracy, currency and lawfulness of the content it makes available to a bot, and for telling Paragus in writing before connecting any source that holds Regulated Data as the Compliance Addendum defines it.

17.3 Output is not advice and is not verified. A bot generates output from the content available to it and may produce output that is incomplete, out of date or wrong. Paragus does not verify bot output, does not warrant its accuracy, and output is not professional, legal, financial, medical or technical advice. Client is responsible for reviewing output before relying on it or acting on it, and Client shall not use bot output as the sole basis for a decision affecting a person’s safety, health, employment, credit or legal rights.

17.4 No availability or performance commitment. Paragus gives no uptime, availability, latency, accuracy or response commitment in respect of a bot or any underlying AI service. §1.4 applies, and §12.4 of the Universal Service Terms applies to any figure stated anywhere in respect of them. A bot being unavailable, degraded, or producing poor output is not a material breach and §4.10 of the Universal Service Terms applies to it.

17.5 Underlying services may change. A bot depends on third-party AI services, which change, are deprecated and are withdrawn outside Paragus’s control. Paragus may change the underlying service, model or configuration at any time, and §12.5 of the Universal Service Terms applies to the third-party service. Where an underlying service is withdrawn and no equivalent is available, Paragus will tell Client and the obligation in §17.1(a) ends, with the corresponding reduction in Client’s Recurring Fee determined under §5.1A(e) of the Universal Service Terms.

17.6 Client Data. §9.5 of the Universal Service Terms governs Paragus’s processing of Client Data through AI-assisted tooling, including the prohibition on using Client Data to train any model made available to a third party. Where a Compliance Addendum applies, §5.5 of that Addendum controls over this Section, and Regulated Data is not processed through any AI service that does not meet the applicable framework’s requirements for that data.

17.7 Ownership. §11 of the Universal Service Terms governs ownership. As between the parties, Client owns the content it supplies to a bot and the output a bot generates from it, and Paragus owns the bot configuration, prompts and tooling. Paragus does not warrant that bot output is original, non-infringing, or capable of protection, and §12 of the Universal Service Terms applies.

17.8 Client’s use. Client shall not use a bot to process data it is not entitled to process or to generate unlawful content. A breach of this Section is a breach by Client, and §7.2 of the Universal Service Terms applies where Paragus’s obligations are affected.

17.9 What is not included. Building a custom bot, integrating a bot with a line-of-business application, developing an automation identified in the assessment, and any work arising from the assessment or the strategy meeting are not included. Each is a Non-Routine Service or a Project under §§7 and 15.

17.10 The assessment and the meeting. The assessment under §17.1(b) and the meeting under §17.1(c) are each delivered once in every twelve-month period. Neither is a commitment to achieve any saving, efficiency or outcome, and any figure either contains is an estimate to which §1.4 applies.