Master Service Agreement

Effective Date: April 8, 2026

This Master Service Agreement (“MSA”) together with any one or more Service Schedule (“Schedule”) referencing this MSA (collectively, the “Agreement”) forms a binding agreement between you (“Customer”), whose name and address appears on the Schedule, and CloudFirst Global, LLC (“CloudFirst”), whose address is 225 Broadhollow Road, Suite 307, Melville , NY 11747. The purpose of this Agreement is to provide a framework governing Customer's access and use of CloudFirst's products and services (“Services”).  In the event of a conflict between this MSA and any Schedule, the order of precedence shall be: (a) the applicable Schedule, and (b) this MSA, unless the applicable document expressly states otherwise. CloudFirst and Customer are sometimes referred to individually in this Agreement as a “Party” and collectively as the “Parties.”

1. Services

The Services include supporting infrastructure, implementation, management, capacity-based resources, performance guarantees, and service levels that collectively comprise a solution, as defined in the applicable Schedule. Service-specific details, definitions, pricing, and responsibilities are set forth in the corresponding Schedule.

2. Term, Termination, Suspension, and Schedules

Each Schedule remains in effect for the initial term defined within it (the “Initial Term”) and will automatically renew for successive periods equal to the Initial Term (each, a “Renewal Term” and together with the Initial Term, the “Term”) unless either Party provides at least sixty (60) days' written notice of non-renewal prior to expiration. Either Party may terminate a Schedule for material breach by providing written notice of such breach and allowing thirty (30) days to cure. Either Party may also terminate this MSA or any affected Schedule immediately upon written notice if the other Party ceases doing business in the ordinary course, admits insolvency, makes an assignment for the benefit of creditors, or becomes subject to any bankruptcy, receivership, or similar proceeding.

If CloudFirst terminates for Customer's breach, before the end of the applicable Term, Customer shall pay: (i) all accrued but unpaid fees, including but not limited to, both NRC and RC (“Service Fees”); (ii) all non-cancellable committed charges for the remainder of the Term; (iii) any prepaid amounts that are non-refundable; and (iv) any third-party or supplier termination, deinstallation, recovery, or cancellation charges incurred by CloudFirst as a result of such termination, to the extent identified in the applicable Schedule.

CloudFirst may suspend some or all Services immediately, with or without notice, if: (a) Customer fails to pay undisputed Fees when due; (b) Customer or any User breaches this Agreement or applicable Third-Party Terms; (c) misuse or a security risk is suspected; or (d) suspension is required by law. Where practicable, CloudFirst will provide notice and an opportunity to cure. Suspension does not relieve Customer of payment obligations.

Provisions of this MSA that, by their nature, should survive termination (including confidentiality, indemnification, and payment obligations) will continue in effect.  Upon termination or expiration of a Schedule, CloudFirst will provide reasonable transition assistance at its then-current rates, subject to mutual agreement on scope and duration.

3. Fees and Payment Terms

Service Fees are set forth in the applicable Schedule. Except as expressly stated in this MSA or an applicable Schedule, all Services are non-cancellable, and all Service Fees, including any prepaid fees, are non-refundable. CloudFirst will invoice Customer on the first day of each calendar month in advance for Services to be provided during that month. Customer's obligation to pay Recurring Charges (“RC”) begins when the Services are provisioned and made available, regardless of usage commencement. Charges beginning on the date Services are first made available (including prorated charges, if applicable) may be included on a subsequent invoice. All invoices are payable within thirty (30) days of issue unless Customer notifies CloudFirst in writing of any invoice dispute within thirty (30) days after the invoice date, specifying the basis for the dispute in reasonable detail. Unless otherwise specified, all fees are stated and payable in U.S. dollars. Customer is responsible for any foreign exchange, bank transfer, or intermediary fees, and CloudFirst shall receive the full invoiced amount. Payments must equal the total invoiced RC and Non-Recurring Charges (“NRC”) exclusive of taxes. Customer waives any right to dispute charges not disputed within that thirty (30) day period. CloudFirst may suspend Services upon ten (10) days written notice if any undisputed invoice remains unpaid after the due date.

RC will be adjusted annually based on changes in the Consumer Price Index for All Urban Consumers (CPI-U), as published by the U.S. Bureau of Labor Statistics, effective on each anniversary of the Agreement.  Third-party manufacturer price increases may be passed through to Customer, and Service pricing may be adjusted at renewal as stated in the applicable Schedule.   In addition, CloudFirst may increase RC upon prior written notice if there are material increases in costs of labor, infrastructure, third-party services, Third-Party Products, licensing, equipment, freight, utilities, or other inputs used to provide the Services, and such increase may take effect on the next monthly billing cycle or Renewal Term, as specified in the notice. A one-time late payment fee of ten percent (10%) applies to all overdue invoices.

4. Taxes

Customer shall be responsible for all applicable taxes, duties, levies, or similar governmental charges, including value-added, goods and services, or sales taxes, arising from the Services, excluding taxes based on CloudFirst's net income. Customer shall provide a valid exemption certificate if claiming any exemption.

5. Customer Data and Security

• Ownership and Access — Customer retains all rights, title, and interest in its data and content stored on CloudFirst's infrastructure (“Customer Data”). To the extent CloudFirst processes personal data on behalf of Customer, the Parties shall enter into a Data Processing Addendum (“DPA”), which is incorporated by reference and governs such processing.
• Security and Notification — CloudFirst will maintain ISO/IEC 27001–aligned administrative, technical, and organizational measures to protect Customer Data. Any confirmed unauthorized access or disclosure of unencrypted Customer Data will be promptly reported to Customer.
• Data Deletion — Upon termination, CloudFirst will delete Customer Data using industry-standard methods in accordance with Customer's written direction specifying the Customer Data to be deleted. Applicable fees may apply for secure data removal.

6. Customer Responsibilities

Customer agrees to cooperate in good faith to enable effective service delivery. Customer is responsible for all acts and omissions of its employees, agents, affiliates, and any individual or entity authorized by Customer, or otherwise accessing or using the Services through Customer's account (“Users”) in connection with the Services, and for all data, content, software, and materials provided, uploaded, transmitted, or made available by or on behalf of Customer through the Services. Key obligations include:

• Authorized Use and Conduct
  Customer and its Users shall not use the Services for any unlawful, fraudulent, abusive, or disruptive purpose, including unauthorized access to systems or data, distribution of malicious code, or transmission of illegal or infringing content. Customer and its Users must comply with all applicable laws in connection with their use of the Services.
• Governance and Communication
  Customer will designate a primary contact authorized for approvals, service changes, and escalations. Customer will participate in onboarding, review, and coordination meetings as reasonably required.
• Legal Compliance and Licensing
  Customer shall maintain all licenses, consents, and approvals required for CloudFirst to provide the Services and ensure all data and software used are properly owned or licensed.
• Transition and Enablement
  Customer shall provide onboarding information (contacts, configuration data, and documentation) within agreed timeframes, typically within five (5) business days of Schedule execution. Failure to do so may result in additional time-and-materials charges for on-site work.
• Network and Access
  Customer shall configure and maintain its network connectivity (including VPNs) unless otherwise specified in a Schedule. CloudFirst's obligations are limited when connectivity failures occur due to Customer-controlled infrastructure.
• Infrastructure and Support
  Customer shall operate and maintain its own equipment and software unless a Schedule specifies otherwise. Customer must follow vendor specifications and environmental requirements.
• Monitoring and Performance
  Customer shall ensure systems are configured to send telemetry or monitoring data as required. CloudFirst may adjust performance thresholds based on due diligence or onboarding results.
• Security Obligations
  Customer must maintain reasonable, up-to-date security controls, including antivirus, firewalls, and patch management. Sensitive and confidential Customer Data must be encrypted where legally or contractually required.
• Documentation and Technical Information
  Customer shall provide or assist in creating necessary documentation, including topology diagrams, maintenance schedules, credentials, and vendor contact details.
• Tools and Vendor Contracts
  Monitoring agents or probes installed by CloudFirst remain its property unless agreed otherwise. Customer is responsible for maintaining third-party support contracts unless transferred via Schedule.
• Recommendations
  Customer agrees to implement CloudFirst's reasonable recommendations necessary for service stability and compliance. CloudFirst is not responsible for service degradation resulting from Customer's refusal to implement such recommendations.
• Required Updates and Changes

Customer shall timely implement required or recommended updates and provide at least thirty (30) days' prior written notice of any changes that may affect the Services. Any technology/versions no longer supported by the respective manufacturer will be viewed as end-of-life and will be supported on a lower priority, “reasonable effort” basis, and no SLAs or guarantees shall apply.

CloudFirst is not responsible for, and Customer waives any SLA credits or remedies for, any issues, outages, or degradation resulting from Customer's failure to implement updates or from Customer-initiated changes not communicated to CloudFirst within the required timeframe. Any resulting work will be performed on a commercially reasonable efforts basis, at CloudFirst's then-current rates.

7. CloudFirst Responsibilities

CloudFirst agrees to:

• Provide portal access, reports, and dashboards related to Customer services;
• Participate in onboarding and review meetings as needed;
• Configure connectivity, including IP addressing and VPN setup, where applicable;
• Deploy and manage agents or monitoring tools as necessary;
• Maintain a primary point of contact authorized to act on behalf of CloudFirst in matters concerning the Services; and

• Adhere to relevant SLAs (https://cloudfirst.host/legal/sla).  Any Service-specific SLAs (if applicable), are shown in the Schedule.

8. Acceptance of Deliverables

CloudFirst may provide onboarding, implementation, or project-based deliverables (“Deliverables”) as part of the Services. Customer shall accept or reject each Deliverable within ten (10) business days of receipt, and any rejection must include written notice of material deficiencies. CloudFirst shall use commercially reasonable efforts to address such deficiencies and resubmit the Deliverable. If Customer fails to timely accept or reject a Deliverable, fails to provide such notice, or uses the Deliverable in a production or operational environment, the Deliverable will be deemed accepted. Upon acceptance (whether express or deemed), the Deliverable will be considered complete, CloudFirst will have no further obligation to modify the Deliverable except as expressly set forth in this Agreement, and any associated fees will become due and payable in accordance with this MSA.

9. Third-Party Products and Pass-Through Terms

CloudFirst may resell or provide access to third-party hardware, software, cloud services, or other products (“Third-Party Products”). Such Third-Party Products are governed by the applicable manufacturer, publisher, or provider terms and conditions (“Third-Party Terms”).

Certain Services may depend on Third-Party Products or services not controlled by CloudFirst. CloudFirst shall not be responsible for any delays, failures, or performance issues caused by such Third-Party Products. CloudFirst makes no warranties regarding Third-Party Products, including hardware, software, or cloud services supplied by third-party manufacturers. All such warranties are provided solely by the applicable manufacturer or provider.

10. Disclaimer of Warranties

Except as expressly set forth in this MSA or an applicable Schedule, the Services, Third-Party Products, and all related materials are provided on an “as is” and “as available” basis. CloudFirst disclaims all other warranties, whether express, implied, statutory, or otherwise, including any implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, and any warranties arising from course of dealing, usage, or trade practice. CloudFirst does not warrant that the Services will be uninterrupted, error-free, or completely secure.

11. Customer No Ownership; CloudFirst Intellectual Property.

Customer acquires no ownership rights in the Services or any CloudFirst systems, infrastructure, software, tools, documentation, methodologies, or other materials used or developed by CloudFirst in providing the Services (“CloudFirst Materials”). All CloudFirst Materials and related intellectual property rights remain the exclusive property of CloudFirst or its licensors. Customer is granted only a limited, non-exclusive, non-transferable right during the Term to access and use the Services for its internal business purposes. No other rights are granted by implication, estoppel, or otherwise.

12. Compliance with Laws

Each Party shall comply with all applicable laws and regulations in connection with its performance under this Agreement and the software used in connection with the Services.

13. Representations and Warranties

Each Party represents and warrants that it:

• Is duly organized, validly existing, and in good standing under applicable law;
• Possesses the necessary power and authority to enter into and perform this MSA;
• Has obtained all required corporate approvals;
• Requires no additional governmental consent to execute or perform this MSA; and
• Will comply with all applicable laws, rules, and regulations.

14. Limitation of Liability and Indemnification

Neither Party shall be liable to the other for any indirect, incidental, special, consequential, or punitive damages, including lost profits or business interruption. Except for (i) indemnification obligations, (ii) gross negligence or willful misconduct, and (iii) payment obligations, CloudFirst's total aggregate liability shall not exceed six (6) months of the prior Recurring Charges (RC) for the affected Services.

Customer shall defend, indemnify, and hold harmless CloudFirst and its affiliates, officers, directors, employees, contractors, and agents from and against any third-party claims, damages, losses, liabilities, fines, penalties, costs, and expenses, including reasonable attorneys' fees, arising out of or relating to: (a) Customer's or any User's use or misuse of the Services; (b) Customer Data, Customer content, or materials provided by or on behalf of Customer; (c) Customer's breach of this MSA, any Schedule, or any Third-Party Terms; (d) Customer's violation of applicable law; or (e) Customer's negligence or willful misconduct.

CloudFirst shall defend, indemnify, and hold harmless Customer from third-party claims alleging that the Services, when used by Customer as authorized and in compliance with this Agreement, infringe a valid United States patent, copyright, or trade secret, provided that CloudFirst may, at its option: (i) modify the affected Services to make them non-infringing; (ii) obtain the right for Customer to continue using the affected Services; or (iii) terminate the affected Services and refund any prepaid Fees for the terminated portion of the unused Term. This paragraph states CloudFirst's sole and exclusive liability, and Customer's exclusive remedy, for any intellectual property infringement claim.

No action arising out of or relating to this Agreement may be brought more than twelve (12) months after the cause of action accrued.

15. Notices

Any notice or other communication regarding the matters contemplated by this Agreement may be sent by U.S. mail (first-class, airmail or express mail), commercial courier, facsimile or electronic mail. Notices to CloudFirst and Customer shall be sent to the Party's address listed on the first page of this Agreement. 

16. No Solicitation of Employees or Subcontractors

During the term of this Agreement and for one (1) year following its termination, neither Party shall, without the prior written consent of the other Party, directly or indirectly solicit for employment, engagement, or contract any employee, subcontractor, consultant, or agent of the other Party with whom it has had contact or became aware of as a result of this Agreement. This prohibition will not apply to job opportunities posted on recruiting websites or in other publications in which one Party seeks to find candidates for open positions (absent direct solicitation and/or recruitment).

17. Governing Law

This MSA shall be governed by and construed in accordance with the laws of the State of Georgia, excluding its conflict-of-law principles.

Any dispute shall be resolved through binding arbitration administered by the American Arbitration Association in Atlanta, Georgia, unless otherwise required by CloudFirst's insurance carrier.

18. Confidentiality and Proprietary Rights

Each party (“Receiving Party”) may receive non-public information of the other party (“Disclosing Party”) that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure (“Confidential Information”). The Receiving Party shall use the Disclosing Party's Confidential Information solely to perform or exercise its rights under this Agreement and shall not disclose such Confidential Information except to its employees, contractors, professional advisors, and subcontractors who have a need to know and are bound by confidentiality obligations at least as protective as those set forth herein.

Confidential Information does not include information that: (a) is or becomes publicly available without breach of this Agreement; (b) was already lawfully known to the Receiving Party without restriction; (c) is lawfully received from a third party without restriction; or (d) is independently developed without use of the Disclosing Party's Confidential Information.

A Receiving Party may disclose Confidential Information to the extent required by law, regulation, or court order, provided it gives prior notice where legally permitted and reasonably cooperates in seeking confidential treatment. Upon termination or request, each Receiving Party shall return or destroy Confidential Information of the Disclosing Party, except as required for legal, backup, or regulatory retention. The obligations of this Section survive for three (3) years after termination, except with respect to trade secrets, which survive for so long as they remain trade secrets under applicable law.

19. Severability

If any provision of this MSA is held invalid or unenforceable, it shall be modified to the minimum extent necessary to comply with applicable law, without affecting the validity of the remaining provisions.

20. Force Majeure

Neither Party shall be liable for delay or failure to perform caused by events beyond its reasonable control, including acts of nature, war, terrorism, pandemics, strikes, or utility failures.

21. Export Compliance.

Each Party is responsible for complying with all applicable export control laws and regulations. Customer is solely responsible for export compliance regarding Customer Data and Content provided to CloudFirst. Customer represents that it is not located in, and will not use the Services in, any jurisdiction subject to applicable sanctions or embargoes, and is not listed on any applicable government restricted party list.

22. Audits

Customer may request reasonable documentation demonstrating CloudFirst's compliance with this Agreement upon reasonable advance written notice, no more than once per year, and subject to CloudFirst's confidentiality and security policies. No access to CloudFirst systems, facilities, or proprietary information shall be required.

23. Assignment

CloudFirst may assign this MSA through merger, acquisition, or reorganization. Customer may not assign this MSA without CloudFirst's prior written consent, which shall not be unreasonably withheld.

24. Insurance

Each Party shall obtain and maintain, at its own expense and throughout the term of this MSA, insurance coverage customary for its business operations, including comprehensive general liability, workers' compensation, professional liability, and such other insurance as it deems reasonably necessary to cover claims, liabilities, or damages that may arise from the performance of its obligations under this MSA.

25. Amendments

CloudFirst may from time to time make changes to the terms of this Agreement, and will notify Customer of such changes by posting them on CloudFirst's website or otherwise communicating them to Customer. Customer shall periodically check CloudFirst's website for such changes. CloudFirst will maintain prior versions of this Agreement and will make them available upon reasonable request. Customer's continued use of CloudFirst's Services after such changes have been communicated constitutes Customer's agreement to the updated terms.

26. Entire Agreement

This Agreement, together with any applicable Schedule(s) constitutes the complete and exclusive agreement between the parties regarding its subject matter and supersedes all prior and contemporaneous agreements and understandings, whether written or oral. Each Party acknowledges that it has not relied on any statements or representations not expressly set forth in this Agreement. There are no conditions precedent to this Agreement other than those expressly stated herein.