INTRODUCTION

This Agreement governs the provision and use of CyberStash’s Managed Detection and Response (MDR) Service package. It outlines the obligations, rights, and limitations applicable to both CyberStash and the Customer, including licensing, support, limitations of liability, and service usage terms. The intent is to ensure clarity, transparency, and enforceability across all aspects of the relationship.

1. DEFINITIONS

Aggregated Statistics – Data derived from Customer’s use of the Services that is anonymised and aggregated for analytical or benchmarking purposes.

Authorized User – Individuals who are authorised by the Customer to access and use the Services, including employees, agents, and contractors.

CyberStash IP – All intellectual property owned or used by CyberStash, including but not limited to the Services, Software, Documentation, trademarks, and Aggregated Statistics.

Customer Data – All information submitted by or on behalf of Customer in connection with the use of the Services, excluding Aggregated Statistics.

Documentation – User manuals, installation guides, and other reference materials provided by CyberStash regarding the Software or Services.

Equipment – Any physical hardware supplied to or purchased by Customer under an Order.

Order – A document, agreement, or subscription form specifying Services, Fees, and related terms, which is executed or otherwise agreed to by the Customer and CyberStash.

Services – The services provided by CyberStash, including but not limited to access to Software, Support Services, and managed security outcomes.

Software – Any proprietary software licensed by CyberStash to Customer, including updates, modifications, and documentation.

Support Services – Technical assistance, maintenance, or troubleshooting support as outlined in Exhibit A.

Term – The duration of the Agreement or the applicable Order, including any renewal terms.

2. MICRO BUSINESS PACKAGE TERMS

Shared Architecture

• Services are delivered via a shared XDR Gateway hosted by CyberStash on AWS infrastructure.
• Customers connect via ZeroTier VPN.
• Dedicated instances, tenant separation, or bespoke hardware deployments are not provided under this package.

Platform Access

• No access is provided to dashboards, interfaces, or direct telemetry exports.
• Security insights are delivered through CyberStash’s managed operations.

Managed Detection and Response (MDR)

• CyberStash delivers 24/7 security monitoring, threat detection, and response.
• Ransomware recovery is best-effort only and subject to conditions. Customers must maintain their own backups and data redundancy.

Service Levels

• Platform availability is aligned with AWS availability SLAs.
• Incident and support response times are detailed in Exhibit A.

Usage Restrictions

• Customers may not:
  
  • Access detection rules or make telemetry changes.
  • Access APIs or underlying infrastructure.
  • Modify or interfere with agents, VPN tunnels, or configurations.
  • Submit support cases except through authorised channels.

Exclusions

• Sections 2(a) (regarding Software installation on Customer Equipment) and Equipment ownership provisions are not applicable.

Data Usage

• Customer Data will only be used to provide and improve the Services.
• CyberStash reserves the right to generate and retain Aggregated Statistics.

3. LICENSE AND USE

License Grant

• Subject to compliance and payment, CyberStash grants the Customer a non-exclusive, non-transferable right to use the Software and Documentation for internal business purposes only.
• This license is restricted to Customer-owned Equipment.
• No license is granted to use unlicensed copies, upgrades, or third-party deployments.

Use Restrictions

Customer shall not:

• Copy, modify, create derivative works of, or reverse engineer the Software.
• Lease, sell, sublicense, assign, or otherwise transfer the Services or Documentation.
• Remove proprietary notices or circumvent technical limitations.
• Use the Services to infringe upon rights or violate any laws.

Reservation of Rights

• All rights not expressly granted are retained by CyberStash.
• No implied licenses or rights are conferred to the Customer or any third party.

Suspension Rights

CyberStash may suspend Services without liability in the event that:

• There is a threat or attack against the CyberStash infrastructure.
• Customer’s use disrupts or poses a security risk.
• Fraudulent, illegal, or unauthorised activity is detected.
• Customer is in bankruptcy or undergoing liquidation.
• Legal restrictions prevent delivery.
• Upstream vendor dependencies are suspended.
• Customer is more than 60 days in arrears.

CyberStash will provide notice where possible and restore services once the triggering issue is resolved.

Aggregated Statistics

• CyberStash may collect, use, and publish Aggregated Statistics provided they do not identify the Customer or expose Confidential Information.

Customer Responsibilities

• Customer is responsible for all activity through its access.
• Customer must ensure compliance by all users.
• Customer must inform users of restrictions and acceptable use obligations.

4. FEES AND TAXES

Fees and Payment

• All fees are invoiced according to the applicable Order.
• Payment is due within 30 days.
• Late payments incur:
  
  • Interest at 1.5% per month or maximum allowed by law.
  • Suspension of Services after 60 days.
  • Recovery of collection costs including legal fees.

Non-refundable Fees

• All fees are non-cancellable and non-refundable, except as expressly provided in this Agreement.

• Customer shall not withhold, set-off, or deduct any amounts from fees due.

Taxes

• Fees exclude all taxes, duties, and charges.
• Customer is responsible for any applicable sales, use, or value-added taxes.

5. CONFIDENTIALITY

Scope

• Confidential Information includes business, technical, or strategic data not publicly known.
• Excludes information that is public, previously known, independently developed, or lawfully disclosed by a third party.

Obligations

• Parties must protect Confidential Information with reasonable care.
• Disclosure is limited to personnel with a legitimate need.

Legal Disclosure

• Required disclosures under law must be preceded by written notice and an attempt to obtain protective orders.

Return or Destruction

• Upon termination, Confidential Information must be returned or destroyed upon request.

Duration

• Confidentiality obligations survive for five (5) years or indefinitely for trade secrets.

6. INTELLECTUAL PROPERTY

Ownership

• CyberStash retains ownership of all intellectual property.
• Customer retains rights over its own data.

Feedback

• Any feedback provided may be freely used by CyberStash for development or commercial purposes.

7. WARRANTIES AND DISCLAIMERS

Limited Warranty

• Software will materially conform to its Documentation.
• Hardware warranties are passed through from original vendors.

Disclaimer

• All Services are provided “as is.”
• CyberStash disclaims all implied warranties including fitness for purpose and non-infringement.

Risk Allocation

• Limitations and exclusions are reflected in the agreed fees and pricing.

8. INDEMNIFICATION

By CyberStash

• CyberStash will indemnify Customer for third-party claims that the Software infringes IP rights.
• CyberStash may modify, replace, or terminate Services to avoid claims.

By Customer

• Customer will indemnify CyberStash from claims, damages, fines, or losses arising out of: 
  • (a) Customer Data;
  • (b) misuse of the Services;
  • (c) breach of this Agreement; or 
  • (d) Customer’s violation of applicable laws or regulations.

Limitation

• This section provides the sole remedies for infringement or third-party IP claims.

9. LIMITATION OF LIABILITY

Exclusion of Damages

• CyberStash shall not be liable for any indirect, incidental, consequential, special, punitive, or exemplary damages, or for any loss of profits, revenue, business opportunity, anticipated savings, goodwill, data, or business interruption, whether or not foreseeable and regardless of the cause of action.

Exclusions from Limitation

• The foregoing limitations shall not apply to:
  • (a) the Customer’s indemnity obligations under this Agreement;
  • (b) the Customer’s breach of confidentiality obligations; or
  • (c) the Customer’s infringement or misuse of CyberStash IP.

• Any claim by the Customer must be brought within six (6) months of the event giving rise to the claim. Claims not made within this period are irrevocably waived.

Liability Cap

• To the maximum extent permitted by law, CyberStash’s total aggregate liability for all claims arising out of or in connection with this Agreement, whether in contract, tort (including negligence), statute, or otherwise, shall not exceed the lesser of:
  
  • (a) an amount equal to twenty-five percent (25%) of the fees actually paid by the Customer in the twelve (12) months immediately preceding the claim; or
  • (b) AUD $20,000. This limitation applies in the aggregate to all claims and causes of action, and not separately to each.

Survival

• This Section survives termination or expiry of the Agreement.

 

---

10. TERMS OF TERMINATION

Term

• Agreement is effective upon execution and continues until terminated.
• Orders renew automatically unless terminated with 30 days’ notice.

• Upon renewal, CyberStash will invoice Customer at then-current rates unless otherwise agreed.

• Either party may terminate due to:
  
  • Uncured breach within 30 days’ notice
  • Insolvency or bankruptcy
  • Legal prohibition on Services

Consequences

• Upon termination:
  
  • Services cease immediately
  • Customer must pay all accrued amounts
  • Confidentiality, IP rights, and indemnity survive

11. MISCELLANEOUS

Entire Agreement

• This Agreement, its Exhibits, and Orders constitute the full agreement.
• In case of conflict:
  
  1. Agreement
  2. Exhibits
  3. Orders

Notices

• Must be in writing and delivered by hand, registered mail, or email.

Force Majeure

• Neither party is liable for delay due to events beyond reasonable control. Force majeure events include, without limitation, acts of God, natural disasters, cyberattacks, denial-of-service attacks, failure of third-party hosting or cloud services, government restrictions, war, terrorism, strikes, or other events beyond CyberStash’s reasonable control.

• The Customer acknowledges that it has not relied on any representations, statements, or warranties other than those expressly set out in this Agreement.

Amendments

• No changes are valid unless in writing and signed by both parties.

Severability

• Invalid terms do not affect the rest of the Agreement.

Data Privacy

• Customer is the controller of all Personal Information provided. CyberStash will process data only to deliver the Services, improve its platform, and for internal research. Data may be processed globally.

Governing Law and Arbitration

• This Agreement shall be governed by, and construed in accordance with, the laws of New South Wales, Australia. The parties irrevocably submit to the exclusive jurisdiction of the courts of New South Wales for the resolution of any disputes arising out of or in connection with this Agreement.

Assignment

• Neither party may assign without written consent, except in merger/acquisition.

Export Compliance

• Customer agrees to comply with all applicable export laws.

Government Use

• The Software is commercial software under applicable procurement regulations.

Equitable Relief

• CyberStash may seek injunctive relief to prevent unauthorised use or IP infringement.

• CyberStash may subcontract performance but remains responsible for its subcontractors.

Customer Obligations

• Customer must:
• • provide access, information, and cooperation needed for CyberStash to deliver the Services;
  • maintain backups of critical systems and data;
  • ensure trained staff use the Services;
  • replace XDR Gateway hardware once vendor support expires; and
  • give CyberStash at least two (2) weeks’ written notice of any work that may impact service delivery, including changes to architecture, IP addressing, or service providers.

EXHIBIT A – SUPPORT SERVICES

Severity Levels and Response Times

Severity	Managed	Premium	Standard &  MiCRO BUSINESS
Critical	≤ 1 hr	≤ 2 hrs	≤ 4 hrs
High	≤ 2 hrs	≤ 4 hrs	≤ 8 hrs
Medium	≤ 2 days	≤ 3 days	≤ 4 days
Low	≤ 3 days	≤ 5 days	≤ 8 days

Support Channels

• Online: Eclipse.XDR Client Portal
• Email: Security Operaitons Centre (SOC) Supprt Desk
• Phone: 1300 893 802

Included Services

• Access to supported platforms and tools
• Updates and bug fixes
• Tracking and case updates via support portal

Return Merchandise Authorisation (RMA)

• Submit RMA request within 30 days
• Follow packaging and return instructions
• Late returns may incur charges

Customer Obligations

• Install latest patches and versions
• Cooperate with diagnostics and issue replication

Exclusions

• CyberStash is not responsible for:
  
  • Third-party systems or software
  • Misuse or operator error
  • Support for outdated versions

Warranty Disclaimer

• Support does not extend or replace warranties in the main agreement

EXHIBIT B – PROFESSIONAL SERVICES RATE CARD

• Where services are requested outside scope, CyberStash may charge at the following rates unless agreed otherwise:
  • Professional Services: AUD $2,500 per day
  • Incident Response beyond five (5) per month: AUD $500 per additional change
  • On-site Support: AUD $3,000 per day plus travel/expenses
• CyberStash may update rates with 30 days’ written notice.