Master Services Agreement
This Master Services Agreement (the "Agreement") is between Carbynix, LLC, a Virginia limited liability company ("Carbynix," "we," "us"), and the customer identified in the Order ("Customer," "you"). It is effective on the date you first accept it (by click-wrap at checkout or by signing an Order).
1. Definitions
"Services" means the Carbynix Managed Detection and Response (MDR) platform and related services described in your Order and at carbynix.com. "Order" means an Order Form or a portal cart you check out. "Customer Data" means data you provide or that the Services collect from your environment, including security telemetry. "Documentation" means the materials Carbynix makes available describing the Services. Other capitalized terms are defined where used or in the documents this Agreement incorporates.
2. Structure of the agreement
This Agreement incorporates by reference, and you also agree to, the Subscription and Billing Terms, the Data Processing Agreement (DPA), the Acceptable Use Policy (AUP), and the applicable SLA Exhibit. Order of precedence, unless a document states otherwise: a signed, negotiated Order; then this Agreement; then the DPA for data-protection matters; then the Subscription and Billing Terms for billing matters; then the AUP and SLA Exhibit.
3. The Services
Carbynix provides MDR: monitoring of your enrolled endpoints and connected sources, detection of suspicious activity, and response support, at the tier and scope in your Order. Tiers and add-ons are described at carbynix.com and priced in your Order. Carbynix may improve or modify the Services so long as it does not materially reduce the core functionality you purchased during your paid term.
4. Customer responsibilities and authorization
You will: provide accurate account information; deploy and maintain the Carbynix agent and any required configuration on the systems you want monitored; and use the Services lawfully and per the AUP. You represent that you are authorized to have Carbynix monitor the systems and process the data you connect, including any required notices to or consents from your personnel or end users. You are responsible for your own regulatory obligations; Carbynix supports them but does not assume them, except as a business associate or service provider where a BAA or data-protection addendum says so.
5. Fees and payment
Fees, minimums, tiers, add-ons, term, and billing cadence are set out in your Order and governed by the Subscription and Billing Terms, including automatic renewal. Payments are processed through Stripe.
6. Term and termination
This Agreement runs for the term in your Order and renews as stated in the Subscription and Billing Terms. Either party may terminate for the other's material breach not cured within 30 days of written notice. On termination, your right to use the Services ends, accrued fees remain due, and data return or deletion follows the DPA.
7. Service standards and the nature of security services
Carbynix will perform the Services in a professional and workmanlike manner and will meet the commitments in the SLA Exhibit. You acknowledge an essential fact about all security services: no monitoring, detection, or response service can detect or prevent every threat, intrusion, or loss. Carbynix does not warrant that the Services will identify or stop all malicious activity, and the Services are one layer of your overall security program, not a guarantee of security.
8. Data protection and security
Carbynix's handling of Customer Data is governed by the DPA, which is incorporated into this Agreement. As between the parties, you own Customer Data. You grant Carbynix the rights to process Customer Data to provide, secure, and improve the Services and to meet legal obligations, as detailed in the DPA. Carbynix maintains an information security program with administrative, technical, and physical safeguards, currently aligning to SOC 2, NIST 800-53, and ISO 27001, not yet certified.
9. Confidentiality
Each party will protect the other's Confidential Information with at least reasonable care, use it only to perform under this Agreement, and not disclose it except to personnel and contractors who need it and are bound by confidentiality. Confidential Information does not include information that is public through no fault of the receiver, independently developed, or rightfully received from a third party. This section does not limit the DPA for personal data.
10. Intellectual property
Carbynix owns and retains all rights in the Services, the platform, its detection content and methodologies, the counterfactual corpus, and the format and methodology of reports and analyses, including improvements and any anonymized or aggregated data that does not identify you or any individual. You own Customer Data and your own confidential materials. Carbynix grants you a non-exclusive, non-transferable right to use the Services and the outputs delivered to you during your term, for your internal business and compliance purposes. If you give feedback, Carbynix may use it without obligation.
11. Warranties and disclaimers
Each party warrants it has the authority to enter into this Agreement. Carbynix warrants the Services will perform materially as described in the Documentation during your term; your exclusive remedy for breach of this warranty is for Carbynix to re-perform the affected Services and, if Carbynix cannot restore materially conforming performance within a reasonable time, for you to terminate the affected Services and receive a pro-rata refund of any fees prepaid for the unperformed portion of the term. Except as expressly stated, the Services are provided "as is," and Carbynix disclaims all other warranties, including merchantability, fitness for a particular purpose, and non-infringement, and any warranty that the Services will be uninterrupted, error-free, or will detect or prevent all threats.
12. Limitation of liability
Neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits or revenue. Except for the Excluded Claims below, each party's total liability arising out of or related to this Agreement is capped at the total fees you paid or owed in the 12 months before the event giving rise to the claim. "Excluded Claims," not subject to the cap, may include: a party's indemnification obligations; breach of confidentiality; your unpaid fees; and a party's gross negligence or willful misconduct.
13. Indemnification
Carbynix will defend you against third-party claims that the Services, as provided, infringe that third party's intellectual property, and will indemnify you for amounts finally awarded, subject to the usual conditions (prompt notice, control of defense, cooperation). You will defend and indemnify Carbynix against third-party claims arising from Customer Data, your use of the Services in violation of this Agreement or law, or your breach of the representations in section 4.
14. Insurance
Carbynix maintains, at its own expense, the insurance coverages stated in its current certificate of insurance, and will provide a certificate of insurance on reasonable request.
15. Compliance with laws
Each party will comply with the laws applicable to it. You are responsible for determining that the Services meet your regulatory requirements and for your own filings and notices; Carbynix will reasonably cooperate, including as a HIPAA business associate or GLBA service provider where an applicable addendum is in place.
16. Publicity
Carbynix will not identify you as a customer or use your logo without your prior written consent.
17. General
Neither party may assign this Agreement without consent, except in a merger or sale of substantially all assets. Notices in writing to the contacts in the Order or, for Carbynix, support@carbynix.com. Force majeure excuses delays beyond reasonable control. This Agreement, with the documents it incorporates and your Order, is the entire agreement and supersedes prior discussions. Amendments to a negotiated Order require a signed writing; Carbynix may update the incorporated online terms prospectively as those documents provide. If a provision is unenforceable, the rest stays in effect. The parties are independent contractors. Carbynix may use subcontractors and sub-processors as the DPA permits and remains responsible for their performance.
18. Governing law and disputes
This Agreement, and any dispute arising out of or relating to it or the Services, is governed by the laws of the Commonwealth of Virginia, without regard to its conflict-of-laws rules. The state and federal courts located in Virginia have exclusive jurisdiction over any such dispute, and each party consents to personal jurisdiction and venue there and waives any objection to it. The Subscription and Billing Terms and the Website Terms of Use reference this section, so governing law and disputes are stated in one place.