Hybrid Support Services Addendum

Overview

This Hybrid Support Services Addendum supplements the Aegisys Master Agreement and applies when a Client transitions from a fully managed services arrangement to a hybrid support model in which administrative rights and responsibilities are shared between Aegisys and the Client.

This addendum clarifies accountability, billing, security response obligations, and change notification requirements under the shared administration model.

Key Definitions

Scope of Aegisys Responsibility

Upon commencement of a Hybrid Support Model, Aegisys's accountability is expressly limited to work performed within the Aegisys Scope. Aegisys does not accept responsibility for the performance, security posture, availability, or integrity of any component of the Covered Environment that has been modified by a Client-Initiated Change.

Key points:

• Aegisys makes no warranty regarding the stability, security, or compliance of systems affected by Client-Initiated Changes
• Aegisys shall not be liable for service degradation, outage, data loss, or compliance failure arising from Client-Initiated Changes
• The Client assumes full responsibility for all Client-Initiated Changes and their consequences

Administrator Access Requirements

As a condition of continued managed services under a Hybrid Support Model, the Client shall maintain and provide Aegisys with current, valid administrator-level credentials for all components of the Covered Environment, including:

• All managed servers and virtual machines
• Network devices (firewalls, switches, routers, access points)
• Cloud management consoles and portals
• Endpoint management platforms
• Any other systems identified in the Aegisys Scope

Updated credentials must be provided to Aegisys within 24 hours of any credential change. Where Aegisys is unable to access any part of the Covered Environment due to missing or revoked credentials, Aegisys's service obligations and response time commitments are suspended until access is restored.

Client Change Notification

The Client shall provide Aegisys with written notice of any planned Client-Initiated Change to the Covered Environment a minimum of 24 hours in advance where practicable. Where advance notice is not practicable (e.g., emergency changes), the Client shall notify Aegisys within 24 hours following the change.

Notifications shall be submitted to:

• Email: [email protected]

Notifications must include:

• A description of the change made or planned
• The system(s) or component(s) affected
• The name of the individual or party performing the change
• The date and approximate time of the change

Out-of-Scope Work and Billing

Any time spent by Aegisys personnel in diagnosing, investigating, troubleshooting, or remediating issues caused by or materially related to a Client-Initiated Change shall be billed to the Client at Aegisys's then-current standard hourly rate.

Key billing terms:

• Where practicable, Aegisys will notify you before commencing Out-of-Scope Work and provide an estimate
• In emergency situations, Aegisys may proceed without prior authorization and will notify you as soon as possible
• Out-of-Scope Work invoices are due upon receipt and non-refundable
• Out-of-Scope Work does not reduce or offset your subscription fees

Security Incident Response

Aegisys will respond to Security Incidents in a Hybrid Support Model on a best-effort basis. Where a Security Incident is caused by, originates from, or is materially complicated by a Client-Initiated Change, Aegisys's standard response time commitments do not apply.

Important considerations:

• Aegisys's ability to perform complete root cause analysis may be limited if full visibility into all administrative activity is unavailable
• Incident response obligations extend only to portions of the Covered Environment within the Aegisys Scope that have not been materially altered by Client-Initiated Changes
• Incident containment and recovery timelines may be extended in hybrid environments
• A Hybrid Support Model may affect your compliance posture under PIPEDA, PHIPA, HIPAA, and SOC 2

Client Acknowledgements

By accepting this Addendum, the Client acknowledges and agrees that:

• The transition to a Hybrid Support Model materially alters the risk profile of the Covered Environment and the accountability of both parties
• Aegisys's service obligations are limited to the Aegisys Scope as defined in the applicable Order Form
• The Client assumes full responsibility for all Client-Initiated Changes and their consequences
• Aegisys has clearly communicated the limitations and risks associated with shared administrative environments

Term and Reversion

This Addendum takes effect upon the earliest of: (a) Client's continued use of Aegisys services 30 calendar days after receipt without written objection, (b) execution by authorized representatives of both parties, or (c) the moment Aegisys provides Client with administrative credentials to any component of the Covered Environment.

Immediate Effect on Credential Exchange: Upon Aegisys providing administrator passwords, access credentials, or any form of authentication to the Client for any component of the Covered Environment, this Addendum becomes immediately effective and binding. The Client's receipt of such credentials constitutes acceptance of all terms herein, including limitations on Aegisys responsibility for Client-Initiated Changes and Out-of-Scope Work billing.

Either party may propose reversion to a fully managed arrangement by providing 30 days' written notice. Upon reversion, Aegisys will restore full administrative control, subject to a re-onboarding assessment and any applicable setup fees.