VaultIQ managed service agreement.

Agreement and status

This VaultIQ Managed Service Agreement (Agreement) is entered into between the Etashi entity identified in Schedule 1 (Etashi) and the client identified in Schedule 1 (Client), together the Parties.

This document is a negotiation template. Bracketed items and Schedule 1 must be completed, and the final agreement should be reviewed by appropriately qualified legal advisers before signature.

Definitions

Additional Standard Module means a generally available VaultIQ module activated for Client in addition to the Initial Solution recorded in Schedule 1.

Client Data means data, content, records, prompts, instructions and materials supplied by or on behalf of Client or generated specifically from them through the Service.

Client-specific Workstream means the single active module or improvement workstream prioritised for Client under clause 6.

Initial Solution means the first agreed business capability recorded in Schedule 1. It may be configured from an existing VaultIQ module or developed for Client through the Client-specific Workstream under Fair Use.

Fair Use means the reasonable, sustainable development capacity described in clause 6. Fair Use is not an hourly entitlement, unlimited development commitment or bankable balance.

Initial Review Period means the first 30 days following Production Activation, during which Client may use the simplified cancellation right in clause 19.

Production Activation means the date on which the managed portal is first made available to Client in a production environment, as recorded in Schedule 1. If the Initial Solution requires development, its release may follow Production Activation.

Provider Charges means attributable third-party charges required to operate Client's Service, including cloud and platform hosting, AI-model usage, messaging and other providers approved in Schedule 1.

Service means the VaultIQ managed service, including the client-facing portal, Initial Solution, managed operation and continuous improvement described in this Agreement.

Agreement structure and priority

This Agreement includes its schedules, any signed order form, statement of work, data processing agreement and written change order. If documents conflict, the following order applies unless expressly agreed otherwise: data processing agreement for personal-data matters; signed change order; Schedule 1; this Agreement; and other schedules.

VaultIQ managed service

Etashi shall provide a managed, white-labelled VaultIQ portal through one controlled entry point. The Service may connect authorised users to approved business knowledge, data, workflows and customer channels according to configured roles and permissions.

• One Initial Solution addressing an agreed business outcome, as recorded in Schedule 1 and delivered under clauses 5 and 6.
• Client-facing branding and configured role-based access.
• Application hosting, controlled deployment, monitoring, maintenance and security patching.
• Correction of reproducible defects introduced by Etashi-developed code or Etashi-controlled configuration, without additional professional-service fees.
• Application backup and agreed service-continuity arrangements.
• Business-hours application support.
• A monthly service and prioritisation review.
• One active Client-specific Workstream managed under Fair Use.

Included take-on and setup

The Parties shall agree one starting business outcome, intended users and acceptance measures in Schedule 1 or an onboarding plan. The subscription includes standard take-on, portal configuration, branding and controlled production activation. If an existing module fits the agreed outcome, its ordinary configuration and launch as the Initial Solution are included.

If no existing module fits, Etashi shall develop the Initial Solution through the single active Client-specific Workstream under Fair Use. The Parties shall agree a practical first scope and review progress together. Production Activation and subscription billing may begin while that solution is still being developed; no fixed completion date is promised unless separately agreed in writing.

Complex legacy integration, substantial data migration, non-standard infrastructure or accelerated implementation is not included unless Schedule 1 expressly states otherwise. Any such work shall be described and priced in a separate statement of work or written change order before it begins.

Client shall provide timely access to relevant personnel, systems, information and approvals. A delay caused by Client or a third party may adjust the implementation timetable without placing Etashi in breach.

Client-specific development and Fair Use

The subscription provides ongoing access to Etashi's development capability through one active Client-specific Workstream at a time. That workstream may develop the Initial Solution where needed, then improve it or pursue the next agreed priority. The Parties shall agree priorities, intended outcomes and delivery pace openly during the monthly review or another agreed governance meeting.

Etashi shall proactively apply available development capacity to the agreed roadmap, including discovery, design, development, testing and controlled release work reasonably required for the active Workstream.

Included development is subject to reasonable Fair Use. It is not measured as a prepaid block of hours or days, is not bankable, does not roll over and does not guarantee completion of a module or milestone within a particular month. Delivery timing depends on scope, technical complexity, dependencies, Client inputs and acceptance requirements.

If demand materially or repeatedly exceeds sustainable included capacity, Etashi shall raise the matter promptly. Before excess work proceeds, the Parties shall agree revised priorities, timing, a reduced scope or additional commercial capacity in writing. Etashi shall likewise identify periods of available capacity and use them proactively to advance the agreed roadmap.

Additional modules and separately scoped work

Each Additional Standard Module is charged at EUR 500 per month, excluding VAT, from production activation until deactivation or termination. This fee includes ordinary hosting, monitoring, maintenance, security updates and business-hours application support for that module. Provider Charges remain subject to clause 8.

Complex integrations or migrations beyond standard take-on, accelerated delivery, parallel workstreams, additional live client-specific capabilities beyond the Initial Solution, client-exclusive ownership terms and 24 x 7 coverage are separately scoped and require written agreement before work begins. Improvements to the Initial Solution remain eligible for the included Workstream under Fair Use.

Fees, invoicing and Provider Charges

The recurring subscription fee is EUR 4,900 per month, excluding VAT, beginning on Production Activation and invoiced monthly in advance unless Schedule 1 states otherwise. Undisputed invoices are payable within [15/30] days.

The subscription includes up to EUR 1,000 per calendar month toward Provider Charges attributable to Client's Service, including cloud and platform hosting, AI-model usage, messaging and other approved operating providers. The allowance does not roll over. Etashi shall use reasonable efforts to notify Client before the allowance is exceeded. Excess Provider Charges approved by Client may be invoiced at cost.

Etashi may suspend affected non-critical work or services for overdue undisputed amounts after written notice and a reasonable cure period. Fees may be changed only by written agreement or on at least [60] days' notice, effective no earlier than the next renewal date.

Service management and support

Etashi shall operate the Service with reasonable skill and care, perform controlled releases and provide business-hours support during the hours stated in Schedule 1. Unless a separate service-level schedule is signed, availability targets and response times are objectives rather than service credits or guarantees.

Etashi is responsible for correcting reproducible defects introduced by Etashi-developed code or Etashi-controlled configuration, without additional professional-service fees. This included correction obligation does not cover new features, changes in requirements, Client or third-party modifications, unsupported use, or defects caused by third-party services outside Etashi's reasonable control.

Etashi may perform planned maintenance and urgent security work. Where practicable, Etashi shall provide advance notice of material planned disruption and communicate material incidents affecting Client's Service.

Client responsibilities and acceptable use

Client is responsible for the legality, accuracy and quality of Client Data; user administration and access approvals; instructions supplied to Etashi; required notices and consents; and the decisions it makes using the Service.

Client shall not use the Service unlawfully, to infringe third-party rights, to introduce malicious code, to defeat security controls, or for prohibited high-risk decisions without appropriate human review and any required legal safeguards.

AI outputs and human oversight

AI-generated outputs may be incomplete, inaccurate or unsuitable for a particular purpose. Client shall apply appropriate human review before relying on outputs for legal, financial, medical, employment, safety-critical or other material decisions.

Etashi does not warrant that AI outputs will be unique, error-free or free from third-party similarity. The Parties shall agree any material output controls, approval gates and prohibited uses relevant to the configured modules.

Client Data

As between the Parties, Client retains all right, title and interest in Client Data. Client grants Etashi a limited licence to host, copy, transmit and otherwise process Client Data solely to provide, secure, support and improve Client's Service and to comply with documented instructions or law.

Etashi shall not use Client Data to train a general-purpose model for unrelated purposes without Client's prior written authorisation. Aggregated or de-identified operational information may be used to secure, support and improve VaultIQ only where it cannot reasonably identify Client, its users or data subjects.

Intellectual property and licences

Etashi and its licensors retain all rights in VaultIQ, reusable frameworks, platform components, tools, methods, know-how and pre-existing or generally applicable materials (Background Technology). No ownership in Background Technology transfers to Client.

Subject to full payment, Etashi grants Client a non-exclusive licence to use the configured Service during the Term. For client-specific configuration, prompts, workflows, documentation and bespoke code created specifically for Client, Etashi shall provide the source-access and transition rights described in clause 19, excluding Background Technology and third-party components.

Client grants Etashi a limited licence to use Client branding and materials only to provide the Service. Neither Party may use the other's name or marks publicly without prior written approval, except as legally required.

Confidentiality

Each receiving Party shall protect the other Party's non-public commercial, technical and business information using at least reasonable care; use it only for this Agreement; and disclose it only to personnel and contractors who need it and are bound by confidentiality obligations.

Confidentiality does not apply to information lawfully public, already known without restriction, independently developed, or lawfully received from a third party. A legally compelled disclosure is permitted where the receiving Party gives advance notice when lawful and reasonably assists with protective measures.

Security

Etashi shall maintain reasonable technical and organisational measures appropriate to the nature of the Service and the risk, including access controls, authentication, encryption in transit, appropriate encryption at rest, logging, vulnerability and patch management, backup and incident-management practices.

No system is completely secure. Client shall promptly report suspected compromise, protect credentials and maintain appropriate endpoint, identity and internal-access controls. Specific security requirements or audit rights must be stated in Schedule 1 or a separate security schedule.

Data protection

Each Party shall comply with applicable data-protection law. Where Etashi processes personal data on Client's behalf, Client is the controller and Etashi is the processor unless the processing context requires another lawful allocation of roles.

Before relevant processing begins, the Parties shall complete Schedule 2 or execute a separate data processing agreement containing the mandatory processor terms under Article 28 of Regulation (EU) 2016/679, including documented instructions, confidentiality, security, subprocessor controls, assistance, return or deletion and audit information.

Client authorises the subprocessors identified in Schedule 2, subject to the notice and objection process stated there. Any restricted international transfer shall use an applicable lawful transfer mechanism and supplementary measures where required.

Warranties

Each Party warrants that it has authority to enter into this Agreement. Etashi warrants that it shall perform the Service with reasonable skill and care and materially in accordance with agreed documentation.

Except as expressly stated and to the maximum extent permitted by law, the Service is provided without other warranties, including implied warranties of merchantability, fitness for a particular purpose, non-infringement or uninterrupted operation.

Liability

Neither Party is liable for indirect, consequential or special loss, or loss of profit, revenue, anticipated savings, goodwill or business opportunity, except to the extent such exclusion is prohibited by applicable law.

Subject to the agreed exclusions and mandatory law, each Party's aggregate liability arising from this Agreement shall not exceed [six/twelve] months of fees paid or payable under this Agreement immediately before the event giving rise to liability. The Parties' legal advisers should complete the cap and any carve-outs for fraud, wilful misconduct, confidentiality, data protection, intellectual property, death or personal injury and unpaid fees.

Term, termination and transition

The Agreement starts on the Effective Date and the recurring subscription operates month to month without a minimum subscription term. Either Party may terminate the subscription at any time on 30 days' written notice. Fees remain payable through the effective termination date, and no fee is refundable for a partially used billing period unless the Parties agree otherwise in writing.

As an exception to the standard notice period, during the Initial Review Period Client may terminate the subscription by written notice received before the next subscription billing date. That termination takes effect at the end of the Initial Review Period and no second base subscription fee will be charged. The first month's base subscription fee is not refundable. Provider Charges above the included allowance, fees for activated Additional Standard Modules, complex integration or migration work and separately approved work incurred up to termination remain payable.

Either Party may terminate for a material breach not cured within [15/30] days after written notice, insolvency or where continued performance would be unlawful. Accrued payment obligations survive termination.

On termination, Etashi shall make Client Data available for export in a reasonably usable format and, at Client's request, delete remaining copies after the agreed retention period unless law requires retention. Subject to payment of applicable fees, Etashi shall provide reasonable transition assistance, current documentation and the agreed source-access materials so Client's appointed provider can continue the client-specific implementation. Background Technology may be supplied only in executable, hosted or separately licensed form.

General

Neither Party may assign this Agreement without the other's consent, not to be unreasonably withheld, except to an affiliate or in connection with a merger, reorganisation or sale of substantially all relevant assets, provided the assignee assumes the obligations.

Neither Party is liable for delay caused by events beyond its reasonable control, excluding payment obligations. The affected Party shall notify the other and use reasonable efforts to mitigate the impact.

Notices shall be sent to the contacts in Schedule 1. Amendments must be in writing and agreed by authorised representatives. Failure to enforce a right is not a waiver. Invalid provisions shall be adjusted or severed without affecting the remainder. The Parties are independent contractors; no partnership, agency or employment relationship is created.

This Agreement is governed by the law stated in Schedule 1 and the stated courts have jurisdiction, subject to any agreed escalation or mediation process. Counterparts and electronic signatures may be used to the extent permitted by applicable law.