Service Agreement & Terms of Service

ResistCyber Service Agreement & Terms of Service

This Agreement is between Resist CyberOps LLC, a Washington limited liability company, doing business as ResistCyber (“we,” “us,” “our”), 822 N M St, Aberdeen, WA 98520, and the business signing up for service (“Client,” “you,” “your”). It is both the service agreement for the managed services you buy and the terms of service for our websites and support tools.

You accept it by checking the acceptance box and completing sign-up, or by using the Services. If you accept on behalf of a company, you represent that you are authorized to bind it. Plain-English notes are marked below; they are for convenience only — the section text controls.

1. What we provide

1.1 Services. We provide the managed security, monitoring, cloud management, and support services described in the plan you select (Resist Monitor, Resist Protect, Resist 365, or Resist Complete), together with AI-guided onboarding, deployment and operation of our monitoring and endpoint-protection agent (the “Agent”), and support at the level your plan provides. Plan inclusions are published on our Products page and summarized in Schedule A; each tier includes everything in the tiers beneath it. Services begin on activation and continue month-to-month.

1.2 Support hours. Support is delivered remotely during 6:00 a.m. – 6:00 p.m. Pacific, Monday–Friday, excluding holidays. Monitoring and automated response run continuously. Response targets and after-hours coverage are in Schedule B.

1.3 Not included. Unless your plan says otherwise, the Services do not include hardware or equipment; project work (migrations, tenant or office moves, network redesign, server builds); remediation of conditions found during onboarding (§2.3); support for end-of-life, unsupported, or unlicensed systems, or devices the Agent is not installed on; custom software and line-of-business application configuration; data recovery from backups you did not purchase; forensic investigation, breach notification, and legal or regulatory advice; and on-site work. Anything outside the Services is quoted separately or billed at the Schedule A rates, and may be drawn from a block of hours.

1.4 Changes. We may change the tools and vendors used to deliver a plan as long as we do not materially reduce its capability. If a change does materially reduce it, we will give thirty (30) days’ notice and you may cancel the affected plan without penalty.

2. Sign-up, approval, and onboarding

2.1 Acceptance. Submitting a sign-up is an offer. This Agreement becomes binding, and Services begin, when we approve the sign-up and confirm activation by email. We may decline any sign-up, in which case nothing is charged and any pending invoice is voided.

2.2 Your contact. You will designate a staff contact, available throughout the term, with authority to approve changes and coordinate onboarding. Onboarding is complete when the Agent is reporting on your covered devices and baseline security policies are applied. Billing is not contingent on your pace of onboarding.

2.3 Pre-existing conditions. Onboarding routinely surfaces existing problems — unsupported systems, missing patches, unlicensed software, compromised accounts, failed or absent backups. We will report what we find and quote remediation. Until it is remediated, we are not responsible for issues arising from a reported condition, and we may exclude specific systems from coverage on written notice.

3. Payment

3.1 Recurring fees. Plan fees are charged per user per month, pre-billed at the beginning of each service month at the rates in Schedule A (for example, May service is billed May 1). Server and workload add-ons are billed per unit per month. Volume discounts apply automatically as described in Schedule A.

3.2 Counting users and devices. If your actual user or managed-device count exceeds the count you are billed for, we will adjust the next invoice to match, effective from the month the additions were made. Reductions take effect on the next invoice after written notice; past months are not credited.

3.3 Terms. Payment is due on receipt. You authorize us to charge the payment method on file for each recurring invoice and any approved additional charges, and you are responsible for keeping it current. A late fee of one and one-half percent (1.5%) per month is added to any amount delinquent more than thirty (30) days. If collection becomes necessary, you are responsible for collection costs, including attorneys’ fees, court costs, and disbursements. Dispute any invoice in writing within thirty (30) days; undisputed amounts remain due on time.

3.4 Time-based work. Remote and telephone support outside a plan is tracked and billed in fifteen (15) minute increments. Work performed at your request outside support hours is billed at 1.5× the applicable rate. On-site visits carry a two (2) hour minimum plus a trip charge covering technician time, mileage, tolls, and parking.

3.5 Blocks of hours. Prepaid Helpdesk and Project Engineering blocks are paid in advance, are non-refundable and non-transferable, carry a four (4) hour minimum, and expire three (3) years after purchase. Helpdesk and Project Engineering hours draw from their own blocks and are not interchangeable; project work performed against a helpdesk block draws at the project rate. If a block runs out mid-engagement, further work continues once more hours are purchased or you authorize hourly billing.

3.6 Licenses, taxes, and rate changes. Third-party licenses purchased through us (including Microsoft) are billed with your plan and are subject to the vendor’s terms, including minimum commitment periods you remain responsible for even if you cancel. If you bring your own licenses, you are responsible for maintaining enough of them, correctly assigned, for the Services to work. Fees exclude sales and similar taxes, which are your responsibility. We may change recurring rates on thirty (30) days’ written notice, effective your next billing period; vendor pass-through increases are applied with as much notice as we receive. Except where stated otherwise, fees are non-refundable, including for partial months.

4. Term, default, and termination

4.1 Term. The Agreement begins on activation and renews automatically each month until cancelled.

4.2 Cancellation. You may cancel at any time by written notice to info@rco.it.com or through the customer portal. Cancellation takes effect at the end of the billing month in which we receive it; the current month is not prorated. Third-party license commitments under §3.6 survive for the balance of their term.

4.3 Default. A party is in default if it fails to materially perform or comply with this Agreement, or, in your case, if you fail to pay an undisputed invoice within thirty (30) calendar days after it is rendered. The party not in default may terminate on written notice if the other fails to cure within thirty (30) days after written notice identifying the default. Remedies are cumulative — electing one does not exclude another. We may terminate immediately, without a cure period, if you use the Services unlawfully, direct us to act unlawfully, materially prevent us from securing your environment, or subject our personnel to abusive conduct.

4.4 Suspension. We may suspend Services while an invoice is more than thirty (30) days past due, or immediately where continued operation presents a security, legal, or safety risk. Suspension does not relieve you of payment. While suspended, monitoring, response, and remediation do not occur and your environment is your sole responsibility.

4.5 Offboarding. On termination we will remove our Agents and management tooling and, if you ask within thirty (30) days, provide reasonable transition assistance at Schedule A rates and export your environment documentation in a commercially reasonable format. After thirty (30) days we may delete Client data held in our management systems, except records we must retain or that age out of routine backups. We will not withhold access to your environment, tenants, credentials, or data over a billing dispute; unpaid amounts are pursued under §3.3.

5. Your responsibilities

Security cannot be delivered from one side. You agree to:

• Provide and maintain the access and permissions in §6, and keep an authorized contact available to us.
• Allow the Agent and required security tooling to be installed and to stay installed, current, and un-excluded on all covered devices.
• Keep multi-factor authentication on all administrative and email accounts, and not remove controls we implement without telling us.
• Keep your user and device counts accurate, and maintain valid licensing for software in your environment.
• Report suspected incidents, phishing, and lost devices promptly, and approve changes we identify as needing your decision.
• Not use the Services or your environment unlawfully, to send unsolicited bulk email, to infringe others’ rights, or to scan or attack systems you do not own or have written permission to test.
• Tell us before placing regulated data (protected health information, cardholder data, government or defense-related information) under management — handling it, including any Business Associate Agreement or framework-specific obligation, requires a separate written agreement. The Services support good security practice but are not a compliance program or certification, and determining and meeting your regulatory obligations remains yours.

If you decline a security recommendation we make in writing, we will document it and continue serving you, and we are not responsible for consequences arising from the declined recommendation.

6. Access and automated action

You authorize us, our personnel, and our subcontractors to access, monitor, configure, and administer your endpoints, servers, cloud tenants, identity systems, and network devices as needed to deliver the Services, including remote and unattended access, and you represent that you have authority to grant that access for every system you place under management.

You further authorize automated and human-initiated protective actions — quarantining or removing files, terminating processes, isolating devices, disabling or resetting accounts, forcing password or session resets, blocking senders or destinations, and applying patches and configuration changes. These may interrupt systems or users, and may occur outside support hours without prior notice where delay would increase risk. We will keep reasonable safeguards over the credentials and access we hold, limit them to personnel who need them, and use them only to deliver the Services and meet our legal obligations. We will follow your written security policies and standards that you have communicated to us.

7. Security reality

If we detect or you report an incident, we will investigate, contain it under §6, keep you informed, and work with you on recovery at the level your plan provides. Work beyond containment and reasonable recovery — extended forensics, rebuilding after a major compromise, ransomware negotiation, evidence preservation, supporting regulatory notification — is project work under §1.3, and we will tell you when work crosses that line. Deciding whether an incident triggers a notification obligation, and making the notification, is yours; we supply the technical facts we hold.

8. Data, confidentiality, and AI

8.1 Your data. Your data remains yours. We process it only to deliver, support, and secure the Services, to meet legal obligations, and as you direct. Delivering the Services necessarily involves collecting telemetry and metadata — device inventory and health, running processes, security events, logs, sign-in activity, ticket contents, and file contents where an investigation requires it. We may retain security telemetry and ticket records after termination for our own security, audit, and legal purposes. Our website and sign-up practices are described in our Privacy Policy. We do not sell or rent customer information.

8.2 Confidentiality. Each party will use the other’s non-public information only as this Agreement allows and will protect it with at least the care it uses for its own confidential information, disclosing it only to personnel and subcontractors under comparable obligations. This does not cover information already public, independently developed, or rightfully received from a third party, and does not prevent disclosure required by law. These obligations continue for three (3) years after termination, and indefinitely for trade secrets.

8.3 Subcontractors. We may use subcontractors and vendors — including our RMM, security, cloud, billing, and communications providers — and we remain responsible for their performance under this Agreement.

8.4 AI and automation. We use automation and artificial intelligence in delivering the Services, including guided onboarding, alert triage and summarization, drafting of responses and documentation, and automated remediation. Automated remediation acts under §6 and may act before a human reviews it; destructive or billing-affecting actions are subject to human review and, where §5 requires, your approval. AI output can contain errors — it is a tool used by our engineers, not a substitute for their judgment, and not legal, compliance, financial, or insurance advice. We do not sell your data and do not permit third parties to use it to train general-purpose models.

9. Warranties

9.1 WE ARE NEITHER A HARDWARE MANUFACTURER NOR A SOFTWARE DEVELOPER, BUT A RESELLER, INTEGRATOR, AND TECHNOLOGY MANAGEMENT SERVICE PROVIDER. WE DO NOT PROVIDE OUR OWN WARRANTIES FOR HARDWARE OR THIRD-PARTY SOFTWARE, BUT MERELY ASSIGN TO OUR CLIENTS THE WARRANTIES, IF ANY, PROVIDED BY THE MANUFACTURER OR SUPPLIER OF THE HARDWARE OR THIRD-PARTY SOFTWARE WE RESELL OR SUB-LICENSE, TO THE EXTENT THOSE WARRANTIES ARE TRANSFERABLE.

9.2 Services warranty. We warrant that the Services will be performed in a manner consistent with customary practice in the industry. If a failure to comply with this warranty appears within thirty (30) days after the Services in question are performed, and you notify us promptly in writing, we will, at our option, perform the Services again or refund the price charged for the non-conforming Services. That re-performance or refund is your exclusive remedy and fulfills all of our liability for the nonconformity, defect, or deficiency.

9.3 THE FOREGOING WARRANTIES ARE EXCLUSIVE AND IN LIEU OF ALL WARRANTIES OF QUALITY AND PERFORMANCE, WRITTEN, ORAL, OR IMPLIED. ALL OTHER WARRANTIES — INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND ANY WARRANTY THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE OR THAT ALL THREATS WILL BE DETECTED OR PREVENTED — ARE DISCLAIMED. THE SERVICES AND ALL THIRD-PARTY PRODUCTS ARE OTHERWISE PROVIDED “AS IS” AND “AS AVAILABLE.”

10. Limitation of remedies and liability

10.1 Exclusive remedies. Our liability on any claim, whether in contract, negligence, tort, strict liability, or otherwise, arising in whole or in part out of the Services, shall in no case exceed the lesser of the fees paid to us for the service period in which the claim arose or the fees paid for the portion of the Services giving rise to the claim. All causes of action arising out of or relating to this Agreement expire unless brought within one (1) year after the first date of performance or breach giving rise to the claim, and you expressly waive any longer period granted by law. These remedies are exclusive and in lieu of all others available at law or in equity.

10.2 No indirect damages. IN NO EVENT WILL WE BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, WHETHER FOR BREACH OF WARRANTY OR OTHER CONTRACT BREACH, NEGLIGENCE OR OTHER TORT, STRICT LIABILITY, OR OTHER THEORY. Without limiting that, we have no responsibility to compensate you for loss of use, loss or miscalculation of data, loss of revenue or increased costs, loss or delay of services, downtime costs, claims of your own clients or other third parties, or lost profits.

10.3 These limits do not apply to your obligation to pay fees, to either party’s indemnification obligations under §11, or to a party’s gross negligence, willful misconduct, or fraud. They apply in the aggregate across all claims and are a fundamental basis of the pricing in Schedule A.

11. Indemnification

You will defend and indemnify us against third-party claims arising from your data or its content, your use of the Services in violation of this Agreement or of law, your failure to maintain required licenses, your instruction to us to take or refrain from an action, and your breach of §5. We will defend and indemnify you against third-party claims that the Services as provided by us infringe a U.S. patent, copyright, or trade secret, and claims arising from our gross negligence or willful misconduct. The indemnified party will notify the other promptly, allow it to control the defense, and cooperate reasonably.

12. Hiring of personnel

Neither party is an employment agency or in the temp-to-hire business, and both invest significantly in obtaining and training personnel. During the term and for one (1) year after written termination, neither party will solicit or entice the other’s employees without the other’s written consent. General public job postings not targeted at the other’s personnel are not a breach. A party hiring the other’s personnel in breach of this section agrees to pay a recruiting fee of fifty percent (50%) of that person’s first-year salary plus any bonuses or commissions.

13. Website and portal use

These terms apply to everyone using our websites, customer portal, and support tools, whether or not they buy Services. Site content is general information, not a warranty, a security assessment of your environment, or professional advice. You may not attempt unauthorized access to our systems, probe or test their vulnerability without written permission, interfere with their operation, scrape them at a volume that degrades service, or use them to distribute malware or unlawful content. Sign-in links and session tokens are personal to the recipient; you are responsible for activity under your account and must report suspected misuse. Our name, logos, content, and design are ours or our licensors’, and our methodologies, scripts, automations, runbooks, and portals remain ours — including improvements made while serving you — licensed to you for internal use during the term and not for resale, sublicensing, or reverse engineering. Documentation specific to your environment (diagrams, inventories, configuration records) is yours to keep. Support tools may be AI-assisted (§8.4); do not submit information you are not authorized to disclose to us. We may suspend access for conduct violating these terms.

14. General

• Changes to this Agreement. We may update this Agreement. Changes materially affecting your rights take effect on your next billing period after at least thirty (30) days’ notice by email or portal; continuing to use the Services then means you accept them, and if you do not, you may cancel under §4.2 first. Non-material changes take effect when posted. Every version carries a version number and effective date, and we retain prior versions.
• Electronic acceptance. Checking the acceptance box and completing sign-up has the same effect as a handwritten signature under the U.S. E-SIGN Act and comparable state law. We record the version accepted, the date and time, the accepting email address, and the originating IP address, and will provide that record and a copy of the accepted version on request. This Agreement may also be executed electronically or in counterparts.
• Notices. Notices are effective when confirmed by email — to us at info@rco.it.com, to you at the primary contact on your account — or when sent certified mail, return receipt requested, postage prepaid, to Resist CyberOps LLC, 822 N M St, Aberdeen, WA 98520. You consent to receive service, billing, security, and administrative communications electronically, including automated alerts; these are not marketing messages.
• Attorneys’ fees. In any suit, arbitration, or action arising out of this Agreement, the prevailing party recovers court costs, disbursements, and a reasonable attorney’s fee as adjudged.
• Force majeure. Each party is excused from performance to the extent prevented by causes beyond its reasonable control — acts of God, war, civil disturbance, court order, labor dispute, third-party nonperformance, utility, internet, or cloud provider failure, or large-scale attacks on infrastructure we do not control. Payment obligations are not excused.
• Independent contractors; assignment. The parties are independent contractors; nothing creates a partnership, joint venture, agency, or employment relationship. Neither party may assign this Agreement without the other’s written consent, except to a successor in a merger or sale of substantially all assets, with notice.
• Publicity. We may identify you as a client by name and logo in our client lists and marketing; you may withdraw that permission in writing at any time.
• Governing law. This Agreement is governed by the laws of the State of Washington, without reference to conflict-of-laws principles. The exclusive venue for any action is the state or federal courts located in Grays Harbor County, Washington, and each party consents to jurisdiction there. Either party may seek injunctive relief in any court of competent jurisdiction to protect confidential information or intellectual property.
• Severability, waiver, survival. An unenforceable provision is modified to the minimum extent necessary and the rest stands. Failure to enforce a provision is not a waiver. Sections 3 (for accrued amounts), 4.5, 7, 8, 9, 10, 11, 12, and 14 survive termination.
• Order of precedence; entire agreement. A signed order, work order, or addendum controls over this Agreement, and this Agreement controls over any website description, quote, or marketing material. This Agreement with its Schedules and the Privacy Policy is the entire agreement between the parties on this subject, superseding prior negotiations and understandings. Pre-printed terms on a purchase order are void. There are no third-party beneficiaries.

Schedule A — Plans and rates

Rates in effect as of the effective date above. Current pricing and plan inclusions are published on our Products page; your recurring invoice reflects the plan, user count, and rate that apply to you.

Volume discount. Plans receive a 1% discount per additional user, up to 10 users (9% maximum), applied to the per-user rate and recalculated when your user count changes. Microsoft licensing may be purchased through us (billed monthly, subject to §3.6) or brought by you and managed under your plan.

Schedule B — Service levels

Monitoring, alerting, and automated response run continuously. The targets below apply to human response and are measured during support hours unless after-hours coverage applies. They are targets, not guarantees, and no service credits attach to them. Response means an engineer has acknowledged and begun work — not that the issue is resolved. We set initial severity from the reported impact and may adjust it after triage.

Availability. Remote support runs 6:00 a.m. – 6:00 p.m. Pacific, Monday–Friday, excluding holidays. After-hours support is available for Severity A incidents and, for all severities, under Resist Complete. Submit requests through the customer portal, by email, or through the support widget so they are tracked — messages sent to individual engineers may not be.