MASTER SERVICE AGREEMENT

This Master Service Agreement ("MSA" or "Agreement") is entered into as of the date of electronic acceptance ("Effective Date") by and between QSai LLC, a Texas limited liability company ("Service Provider"), and the entity or individual identified at time of engagement ("Client"). By clicking "Accept" or by otherwise engaging the Services on our website, Client agrees to be bound by the terms and conditions of this Agreement.

1. DEFINITIONS

1.1 "Agreement" means this Master Service Agreement, including all exhibits, schedules, Statements of Work ("SOW"), and any amendments incorporated by reference.

1.2 "Services" means all cybersecurity consulting, offensive security assessments, vCISO/fractional CISO advisory, AI-augmented security, GRC advisory, incident response, training, platform access, digital products, and related services provided by Service Provider under this Agreement or any SOW.

1.3 "AI-Augmented Services" means any Services incorporating AI models — including Anthropic Claude and OpenAI models accessed under verified partner programs — to assist with analysis, report generation, policy drafting, threat identification, or compliance advisory. Outputs from AI models are reviewed by a qualified practitioner before delivery to Client.

1.4 "Offensive Security Assessment" means a security evaluation service including penetration testing, vulnerability assessments, red team exercises, and other authorized simulated attacks designed to identify security weaknesses, as further detailed in the applicable SOW.

1.5 "Testing Environment" means the systems, networks, or applications designated by Client and authorized in writing for the purpose of conducting an Offensive Security Assessment.

1.6 "Deliverables" means all reports, documents, analyses, policies, templates, tools, presentations, and other materials developed or delivered by Service Provider to Client under this Agreement.

1.7 "Client Data" means any data, information, documents, or system access provided by Client to Service Provider in connection with the Services.

1.8 "Confidential Information" means any non-public information disclosed by one Party to the other that is designated as confidential, or that reasonably should be understood to be confidential given the nature and circumstances of disclosure. Includes business strategies, security postures, network configurations, pricing, client lists, and technical data.

1.9 "Background IP" means Service Provider's pre-existing methodologies, frameworks, tools, templates, software, AI prompt libraries, and know-how existing before the Effective Date or developed independently of any specific engagement.

2. SCOPE OF SERVICES

2.1 Engagement. Service Provider shall perform Services as described in each executed SOW. Each SOW shall detail scope, deliverables, timelines, milestones, fees, and any special terms for that engagement.

2.2 Change Management. Any changes to the scope of Services must be agreed upon in writing by both Parties via an amended SOW or written change order before additional work begins.

2.3 Client Authorization. Client represents and warrants that it holds all necessary rights, consents, and permissions to authorize the Services on the systems or data specified in the SOW, and that such systems are fully under Client's control or otherwise lawfully accessible.

2.4 Offensive Security Testing Protocol. Where an Offensive Security Assessment is engaged:

• (a) Client acknowledges that simulated cyber-attacks, despite reasonable precautions, may result in temporary system slowdowns or disruptions.
• (b) Client agrees to implement appropriate backups, contingency plans, and notify relevant internal stakeholders before testing commences.
• (c) Service Provider will exercise commercially reasonable care but shall not be liable for indirect or unforeseen outcomes resulting from authorized testing activities.
• (d) All testing is limited strictly to the authorized Testing Environment defined in the SOW.

2.5 AI Tool Usage. Where AI-Augmented Services are engaged, Client acknowledges that AI model outputs are probabilistic and subject to model limitations. Service Provider applies professional judgment in validating all AI-assisted outputs before delivery. Outputs are not guaranteed to be error-free.

2.6 Subcontractors. Service Provider may engage qualified subcontractors to fulfill Services. Service Provider remains responsible for subcontractor performance and confidentiality.

3. CLIENT RESPONSIBILITIES

3.1 Access and Cooperation. Client agrees to provide timely access to systems, personnel, and information reasonably required to perform the Services, including designating a primary contact with authority to make engagement decisions.

3.2 Data Accuracy. Client warrants that all information and data provided to Service Provider is accurate, complete, lawfully shareable, and up to date.

3.3 Compliance. Client shall comply with all applicable laws and regulations, and shall obtain any necessary internal authorizations and third-party consents before engaging Services or granting system access.

3.4 Pre-Assessment Notification. For Offensive Security Assessments, Client agrees to notify all affected internal and third-party stakeholders and secure all necessary approvals before commencement of any testing activities.

3.5 Approvals. Client agrees to review and approve Deliverables within timelines agreed in the SOW. Delayed approvals may extend delivery schedules without constituting a breach by Service Provider.

4. FEES, EXPENSES, AND PAYMENT

4.1 Fees. Client shall pay all fees as set forth in the applicable SOW. Fees do not include applicable taxes, which are Client's responsibility unless otherwise required by law.

4.2 Payment Schedule. Unless otherwise stated in the applicable SOW: 50% of the total engagement fee is due upon SOW execution; the remaining 50% is due upon delivery of final Deliverables. Retainer engagements are billed monthly in advance.

4.3 Expenses. Client shall reimburse Service Provider for reasonable pre-approved out-of-pocket expenses (travel, tools, third-party services) incurred in connection with the Services, at cost.

4.4 Late Payment. Invoices not paid within fifteen (15) days of the due date accrue interest at 1.5% per month or the maximum rate permitted by applicable law.

4.5 Disputed Invoices. Client must notify Service Provider of a disputed invoice within ten (10) business days of the invoice date. Undisputed portions remain due. Parties will resolve disputes in good faith within thirty (30) days.

4.6 Suspension for Non-Payment. Service Provider may suspend Services — including platform access — for fees overdue by more than thirty (30) days, with five (5) business days' written notice. Services resume upon payment of all overdue amounts.

4.7 Scope Changes. Work outside agreed scope, documented in a written change order, may incur additional charges as agreed by the Parties.

5. INTELLECTUAL PROPERTY

5.1 Background IP. Service Provider retains all right, title, and interest in its Background IP. Nothing in this Agreement transfers ownership of Background IP. Background IP incorporated into Deliverables is licensed — not transferred — to Client on a non-exclusive, perpetual, royalty-free basis for Client's internal business use only.

5.2 Deliverables — Default Ownership. All Deliverables are and remain the property of Service Provider unless a SOW expressly designates specific Deliverables as "work made for hire" assigned to Client. Where a SOW does so designate, and upon Client's full payment, ownership of those designated Deliverables transfers to Client. The underlying Background IP, frameworks, and methodologies incorporated into any Deliverable always remain Service Provider's property.

5.3 AI Model Outputs. Deliverables generated with the assistance of third-party AI models (Anthropic Claude, OpenAI) are subject to those providers' acceptable use policies. Service Provider warrants that its use of such models complies with applicable provider terms.

5.4 Client Data. Client retains all right, title, and interest in Client Data. Service Provider may use Client Data solely to deliver Services and fulfil obligations under this Agreement.

5.5 Feedback. Client grants Service Provider a perpetual, royalty-free licence to use feedback, suggestions, or enhancement requests to improve its Services and Platform, without attribution or compensation to Client.

5.6 Restrictions. Client shall not modify, reverse engineer, sublicense, or distribute any Service Provider intellectual property without prior written consent.

5.7 Third-Party Materials. Third-party software or tools incorporated into Deliverables are subject to applicable third-party licences.

6. CONFIDENTIALITY AND DATA SECURITY

6.1 Confidentiality Obligations. Each Party ("Receiving Party") agrees to: hold the other Party's ("Disclosing Party") Confidential Information in strict confidence; use it only for purposes of this Agreement; and disclose it only to employees, contractors, or advisors who need to know and are bound by equivalent confidentiality obligations.

6.2 Exclusions. Confidentiality obligations do not apply to information that: (a) is or becomes publicly available through no fault of the Receiving Party; (b) was rightfully known to the Receiving Party before disclosure; (c) is independently developed without use of Confidential Information; or (d) is required to be disclosed by law, regulation, or court order — in which case the Receiving Party provides prompt prior written notice where permitted.

6.3 Duration. Confidentiality obligations survive termination of this Agreement for three (3) years, except for trade secrets, which remain protected indefinitely.

6.4 Data Security. Service Provider implements commercially reasonable administrative, technical, and physical safeguards to protect Client Data, including encrypted storage and transit, role-based access controls, and vendor security vetting for material sub-processors.

6.5 Data Breach Notification. In the event of a confirmed security incident affecting Client Data, Service Provider shall notify Client within 72 hours of confirming the breach and cooperate in reasonable investigation and mitigation efforts.

6.6 Data Retention and Return. Upon termination of an engagement or upon Client request, Service Provider will return or securely delete Client Data within thirty (30) days, except where retention is required by applicable law.

6.7 GDPR / CCPA. Where Services involve processing of personal data subject to GDPR or CCPA, the Parties may execute a separate Data Processing Addendum (DPA). Service Provider's standard DPA is available at cyberadx.network/dpa.

7. REPRESENTATIONS AND WARRANTIES

7.1 Mutual Representations. Each Party represents and warrants that it has the authority to enter into this Agreement, that its performance will not violate any applicable law or contractual obligation, and that it is not subject to any legal restriction preventing performance.

7.2 By Service Provider. Service Provider warrants that: (a) Services will be performed in a professional and workmanlike manner consistent with industry standards; (b) it holds all necessary rights to grant the licences described herein; and (c) Services will not knowingly infringe third-party intellectual property rights. Service Provider does not warrant that Services will identify every vulnerability or risk, or that AI-assisted outputs will be free from error.

7.3 By Client. Client warrants that: (a) Client Data provided to Service Provider does not violate any third-party rights or applicable law; and (b) it has obtained all necessary consents and authorisations for system access granted to Service Provider.

7.4 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION, THE SERVICES ARE PROVIDED "AS IS." SERVICE PROVIDER DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. CYBERSECURITY SERVICES REDUCE RISK BUT DO NOT ELIMINATE IT — SERVICE PROVIDER DOES NOT WARRANT THAT SERVICES WILL PREVENT ALL SECURITY INCIDENTS.

8. LIMITATION OF LIABILITY AND INDEMNIFICATION

8.1 Liability Cap. TO THE MAXIMUM EXTENT PERMITTED BY LAW, SERVICE PROVIDER'S TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING UNDER OR RELATED TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL FEES PAID BY CLIENT TO SERVICE PROVIDER IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE CLAIM.

8.2 Exclusion of Consequential Damages. IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES — INCLUDING LOST PROFITS, LOSS OF DATA, OR BUSINESS INTERRUPTION — EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

8.3 Exceptions. The limitations in 8.1 and 8.2 do not apply to: (a) Client's payment obligations; (b) either Party's indemnification obligations; (c) breaches of confidentiality; or (d) damages arising from gross negligence or wilful misconduct.

8.4 Indemnification by Client. Client agrees to indemnify, defend, and hold harmless Service Provider and its officers, employees, and agents from third-party claims, damages, and costs (including reasonable legal fees) arising from: (a) Client's breach of this Agreement; (b) Client Data infringing third-party rights; (c) Client's negligence or wilful misconduct; or (d) Client's use of Deliverables outside the scope of this Agreement.

8.5 Indemnification by Service Provider. Service Provider agrees to indemnify, defend, and hold harmless Client from third-party claims arising from: (a) Service Provider's gross negligence or wilful misconduct; or (b) Deliverables infringing third-party intellectual property rights, provided Client promptly notifies Service Provider of such claims and cooperates in the defence.

9. TERM AND TERMINATION

9.1 Term. This Agreement commences on the Effective Date and remains in effect until terminated. Individual SOWs have their own terms.

9.2 Termination for Convenience. Either Party may terminate this Agreement or any SOW upon thirty (30) days' written notice. Termination of the MSA does not automatically terminate active SOWs unless each is separately terminated.

9.3 Termination for Cause. Either Party may terminate this Agreement or any SOW immediately upon written notice if the other Party: (a) materially breaches this Agreement and fails to cure within fifteen (15) days of written notice; (b) becomes insolvent, makes an assignment for the benefit of creditors, or commences a bankruptcy proceeding; or (c) engages in fraud or wilful misconduct.

9.4 Effect of Termination. Upon termination: (a) Client shall pay for all Services rendered through the termination date; (b) each Party shall promptly return or destroy the other's Confidential Information; (c) licences granted to Client survive for Deliverables already paid for in full; and (d) Sections 5, 6, 7, 8, and 10 survive termination.

10. DISPUTE RESOLUTION

10.1 Good Faith Negotiations. The Parties agree to escalate disputes to senior management and attempt resolution in good faith within thirty (30) days of written notice before initiating arbitration.

10.2 Arbitration. If not resolved within thirty (30) days, disputes shall be submitted to binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules, with a single arbitrator, seated in Houston, Texas. The arbitrator's decision shall be final and binding. Judgment may be entered in any court of competent jurisdiction.

10.3 Injunctive Relief. Either Party may seek injunctive or other equitable relief in a court of competent jurisdiction to prevent irreparable harm pending arbitration.

10.4 Governing Law. This Agreement is governed by the laws of the State of Texas, United States of America, without regard to conflict of law principles.

11. MISCELLANEOUS

11.1 Force Majeure. Neither Party is liable for delay or failure to perform resulting from circumstances beyond their reasonable control, including acts of God, government actions, pandemics, cyberattacks on third-party infrastructure, natural disasters, or telecommunications failures. The affected Party will provide prompt written notice and use commercially reasonable efforts to resume performance.

11.2 Notices. Legal notices must be in writing and delivered by certified mail, courier, or email with confirmation of receipt. Notices to Service Provider: legal@cisomarketplace.services. Notices to Client: the designated contact on record.

11.3 Assignment. Neither Party may assign this Agreement without prior written consent, except that Service Provider may assign it in connection with a merger, acquisition, or sale of substantially all its assets.

11.4 Entire Agreement. This Agreement, together with all executed SOWs, constitutes the entire agreement between the Parties regarding its subject matter and supersedes all prior agreements, proposals, and representations.

11.5 Amendments. No amendment is effective unless in writing and signed by authorised representatives of both Parties.

11.6 Severability. If any provision is held invalid or unenforceable, the remaining provisions continue in full force.

11.7 Waiver. Failure to enforce any right is not a waiver of future enforcement.

11.8 Survival. Provisions that by their nature extend beyond termination — including confidentiality, IP, limitation of liability, indemnification, and governing law — survive termination of this Agreement.

11.9 Relationship. The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, employment, or agency relationship.

11.10 Counterparts. This Agreement may be executed electronically. Electronic signatures are valid and binding.

12. ACCEPTANCE

By clicking "Accept," purchasing Services, or executing a Statement of Work referencing this Agreement, Client acknowledges that it has read, understood, and agrees to be bound by this Master Service Agreement.

13. CONTACT

QSai LLC d/b/a CISO Marketplace
Legal: legal@cisomarketplace.services
General: info@cisomarketplace.services
Platform: cisomarketplace.services