MASTER IT SERVICES AGREEMENT

Heaven Technology LLC — Exclusive IT Membership Plan

This Master IT Services Agreement (“Agreement”) is entered into as of the date of Customer’s electronic enrollment (the “Effective Date”) by and between:

PROVIDER: Heaven Technology LLC, a New Mexico limited liability company, with its principal place of business at 5830 Franklin Rd SE, Deming, NM 88030 (“Provider,” “we,” “us,” or “our”).

CUSTOMER: The individual or entity that electronically enrolls in the Exclusive Membership Plan through Provider’s website (the “Customer,” “you,” or “your”).

Collectively referred to as the “Parties” and individually as a “Party.”

RECITALS

WHEREAS, Provider is in the business of providing information technology support, managed services, cybersecurity, cloud administration, and related professional services; and

WHEREAS, Customer desires to engage Provider to deliver the Exclusive Membership Plan services as described herein; and

WHEREAS, the Parties intend for this Agreement to constitute a complete, binding, and enforceable contract under the laws of the State of New Mexico;

NOW, THEREFORE, in consideration of the mutual covenants, promises, and agreements contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

ARTICLE 1 — DEFINITIONS

1.1 “Services” means the specific IT support services described in Article 2 of this Agreement, as may be modified in writing by mutual agreement.

1.2 “Service Period” means each calendar month during which the Agreement is in effect, beginning on the 1st day and ending on the last day of that month.

1.3 “Initial Term” means the period of twelve (12) consecutive Service Periods beginning on the day immediately following the expiration of the Free Trial Period.

1.4 “Free Trial Period” means the first seven (7) calendar days following the Effective Date, during which Customer receives full Exclusive-level Services at no charge.

1.5 “Renewal Term” means each successive month-to-month period following the Initial Term.

1.6 “On-Site Visit” means a scheduled or emergency visit by a Provider technician to Customer’s physical location, including up to four (4) hours of on-site work per visit. On-Site Visits are unlimited in number under this Agreement.

1.7 “Ticket” means any request for technical assistance submitted by Customer via phone, email, web form, or monitoring alert.

1.8 “Endpoint” means any computer, laptop, tablet, server, or similar device managed by Provider under this Agreement.

1.9 “Data” means all information, files, documents, emails, databases, and other digital content stored on Customer’s systems, in Customer’s cloud environments, or in Customer’s possession, regardless of medium.

1.10 “Confidential Information” means any non-public information disclosed by either Party to the other in connection with this Agreement, including but not limited to business plans, financial data, customer lists, technical specifications, security configurations, network architecture, cloud credentials, and proprietary processes.

1.11 “Early Termination Fee” or “ETF” means the sum of all remaining monthly fees through the end of the Initial Term, as described in Article 5.

1.12 “SLA” means the Service Level Agreement described in Article 6.

1.13 “Out-of-Scope Work” means any service, repair, project, or task not explicitly included in the Services described in Article 2.

1.14 “Full Cybersecurity Stack” means the layered security suite described in Section 2.1(d), including EDR, email security gateway, MFA management, firewall management, vulnerability scanning, patch management, and security awareness training.

1.15 “Cloud Environments” means Customer’s Microsoft 365 tenant, Azure subscription, and any other cloud-based infrastructure managed by Provider under this Agreement.

1.16 “Critical Incident” means any event that causes or is likely to cause a complete or near-complete loss of business operations, a confirmed security breach, or total loss of access to Customer’s primary systems or Data.

1.17 “Dedicated IT Manager” means a named, assigned Provider professional who serves as Customer’s primary point of contact, is familiar with Customer’s environment, and is responsible for coordinating all aspects of the Services, including strategy, project management, and escalation.

1.18 “Uptime SLA” means the 99.9% monthly uptime guarantee described in Section 6.7, including the associated credit structure.

1.19 “Executive Dashboard” means the real-time and historical reporting interface provided to Customer under Section 2.1(k), displaying system health, security posture, ticket metrics, SLA compliance, and strategic KPIs.

1.20 “Preferred Pricing” means the discounted hardware and software pricing arrangement described in Section 2.1(l), under which Provider extends negotiated volume discounts to Customer on hardware and software purchases.

1.21 “Project Management” means the structured planning, coordination, tracking, and delivery of defined IT projects as described in Section 2.1(m).

1.22 “Annual IT Budget Plan” means the comprehensive annual budgeting document and planning session described in Section 2.1(n), covering projected IT spending, capital planning, subscription renewals, and strategic technology investments.

ARTICLE 2 — SERVICES & SCOPE

2.1 Included Services. Provider shall deliver the following services to Customer during each Service Period:

(a) 24/7 Help Desk & Monitoring. Round-the-clock remote monitoring of Customer’s entire IT infrastructure, including servers, workstations, network devices, cloud environments, and security tools. Help desk support available 24 hours per day, 7 days per week, 365 days per year.

(b) 15-Minute Response Time. Provider shall respond to all Tickets within fifteen (15) minutes of submission, 24/7/365. This includes phone, email, web form, and monitoring-generated alerts.

(c) Proactive Issue Resolution. Provider shall actively monitor for and resolve emerging issues before they cause business impact, including but not limited to: disk degradation, service failures, certificate expirations, bandwidth anomalies, security alert triage, and performance degradation.

(d) Full Cybersecurity Stack. Provider shall deploy, manage, and maintain a layered cybersecurity program including: (i) Endpoint Detection and Response (EDR) on all managed Endpoints; (ii) email security gateway with phishing and malware filtering; (iii) multi-factor authentication (MFA) management and enforcement; (iv) firewall configuration, rule management, and monitoring; (v) quarterly vulnerability scanning with remediation recommendations; (vi) automated operating system and application patch management; and (vii) annual security awareness training for Customer’s staff.

(e) Cloud Management (Microsoft 365 & Azure). Provider shall administer Customer’s Cloud Environments, including: user account management, mailbox configuration, licensing management, sharing and permission controls, security policy configuration, migration planning and execution, cost monitoring and optimization, and integration with on-premises infrastructure.

(f) Backup & Disaster Recovery (DR) Management. Provider shall configure, manage, and monitor automated backup solutions for Customer’s critical systems and Data. Provider shall perform verified restore testing at least monthly and maintain tested disaster recovery procedures. Provider shall document RPO (Recovery Point Objective) and RTO (Recovery Time Objective) targets agreed upon with Customer during onboarding.

(g) Network Monitoring & Optimization. Provider shall continuously monitor Customer’s network infrastructure (routers, switches, firewalls, access points, and WAN links) for performance, availability, and security. Provider shall tune configurations, manage bandwidth policies, and recommend or implement optimizations to maintain network health.

(h) Unlimited Same-Day On-Site Visits (Guaranteed). Provider shall perform as many On-Site Visits as reasonably necessary during each Service Period at no additional charge, with a guaranteed same-day on-site response for all requests. Each On-Site Visit includes up to four (4) hours of on-site work. Additional time beyond four (4) hours per visit is billed at $85/hour with Customer’s prior approval.

(i) Dedicated IT Manager. Provider shall assign a named Dedicated IT Manager to Customer. The Dedicated IT Manager shall: (i) serve as Customer’s primary and consistent point of contact for all IT matters; (ii) be familiar with Customer’s specific environment, business processes, and strategic goals; (iii) coordinate all Tickets, On-Site Visits, projects, and strategy sessions; (iv) proactively communicate status updates, risks, and recommendations; and (v) be available for direct phone and email contact during business hours with response within fifteen (15) minutes during Critical Incidents. In the event the assigned Dedicated IT Manager is unavailable for an extended period (exceeding ten (10) Business Days), Provider shall assign a qualified replacement and notify Customer within two (2) Business Days.

(j) Quarterly IT Strategy Sessions. Provider shall conduct a quarterly in-person or executive-level strategy session (60–90 minutes) with Customer’s leadership team. Each session shall cover: (i) system health assessment and performance trends; (ii) security incident and near-miss review; (iii) backup and DR test results; (iv) cloud spend analysis and optimization opportunities; (v) upcoming maintenance windows; (vi) 90-day IT roadmap; (vii) strategic technology recommendations aligned with Customer’s business objectives; and (viii) competitive and industry technology trend briefing. Provider shall deliver a written executive summary and action items within five (5) Business Days of each session.

(k) Executive Dashboards & Reporting. Provider shall provide Customer with access to a real-time Executive Dashboard displaying: (i) system uptime and availability metrics; (ii) security posture score and incident summary; (iii) ticket volume, resolution times, and SLA compliance; (iv) network performance and bandwidth utilization; (v) backup status and RPO/RTO compliance; (vi) cloud spend and cost optimization recommendations; (vii) patch compliance and vulnerability status; and (viii) project status and milestones. Provider shall also deliver a written monthly executive report summarizing key metrics, incidents, and strategic recommendations within five (5) Business Days of month-end.

(l) Preferred Hardware/Software Pricing. Provider shall extend to Customer preferred pricing on all hardware and software purchases facilitated by Provider. “Preferred Pricing” means: (i) negotiated volume discounts from Provider’s hardware and software vendors, passed through to Customer at or below Provider’s acquisition cost; (ii) a minimum of five percent (5%) discount off list price on all hardware and software purchases exceeding $500; and (iii) Provider shall always present at least two alternatives when a purchase exceeds $500. This arrangement is in addition to the at-cost pass-through described in Section 2.3.

(m) Project Management (Included). Provider shall provide structured project management for all IT projects initiated by Customer or recommended by Provider, including: (i) project scoping and requirements definition; (ii) timeline and milestone planning; (iii) resource allocation and coordination; (iv) progress tracking and status reporting; (v) risk identification and mitigation; (vi) stakeholder communication; and (vii) project closeout documentation. Up to two (2) concurrent projects are included in the monthly fee. Additional concurrent projects beyond two (2) are billed at $250/project/month or $85/hour, whichever is greater, with Customer’s prior written approval.

(n) Annual IT Budget Planning. Once per calendar year (Q4 or as mutually agreed), Provider shall conduct a dedicated annual IT budget planning session (90–120 minutes) with Customer’s leadership. The session shall produce a written Annual IT Budget Plan covering: (i) projected IT spending for the coming year (operational and capital); (ii) subscription and licensing renewal schedule and costs; (iii) hardware refresh cycle and capital expenditure planning; (iv) cloud cost optimization opportunities; (v) security investment recommendations; (vi) technology roadmap aligned with business strategy; and (vii) risk assessment and contingency budget. Provider shall deliver the written Annual IT Budget Plan within ten (10) Business Days of the session.

(o) Priority Phone Support. Customer receives priority access to the Dedicated IT Manager and a dedicated escalation path. Calls are not routed through a general queue or call center.

2.2 Exclusions. The following are expressly NOT included in the Services and constitute Out-of-Scope Work:

(a) Full-time on-site IT technician permanently stationed at Customer’s location (the Dedicated IT Manager is a remote/visiting role, not an on-site employee);

(b) Custom software development, application building, or bespoke coding;

(c) Data center colocation management or physical facility management;

(d) Multi-site enterprise deployment exceeding ten (10) physical locations (additional sites may be added at $999/site/month with a separate agreement);

(e) Compliance audit preparation or attestation (HIPAA, SOC 2, PCI-DSS, ISO 27001) — Provider will implement technical controls but does not perform audit work;

(f) Hardware procurement, resale, or physical repair beyond component replacement during an On-Site Visit (hardware is sourced at Preferred Pricing as described in Section 2.1(l));

(g) Legal, accounting, or compliance advisory services;

(h) Any service requiring more than eight (8) hours of combined remote and on-site work in a single Ticket without prior written authorization;

(i) More than two (2) concurrent managed projects (additional projects billed per Section 2.1(m)).

2.3 Out-of-Scope Billing. Any Out-of-Scope Work requested by Customer will be quoted in writing before commencement. Customer must approve the quote in writing (email suffices) before Provider proceeds. Approved Out-of-Scope Work is billed at Provider’s then-current hourly rate of $85/hour, with a one (1) hour minimum. Hardware and software purchases are provided at Preferred Pricing as described in Section 2.1(l).

2.4 Best Efforts. All Services are provided on a best-efforts basis in accordance with generally accepted industry standards. Provider does not guarantee any specific outcome, resolution time beyond the SLA in Article 6, or that all issues will be resolvable. Some problems may be unsolvable, require third-party vendor support, or exceed the scope of this Agreement.

2.5 No Guarantee of Security. Provider implements the Full Cybersecurity Stack and maintains industry-standard security controls. However, Provider does not and cannot guarantee that Customer’s systems, networks, or Data will be free from intrusion, attack, vulnerability, or compromise. The cybersecurity landscape is dynamic, and no set of measures can eliminate all risk. Customer acknowledges and accepts this inherent risk.

2.6 Uptime Guarantee. Notwithstanding Section 2.6 of the Pro plan, Provider commits to the 99.9% Uptime SLA described in Section 6.7 of this Agreement. Downtime caused by Customer’s hardware, Customer’s ISP, third-party service providers (including Microsoft, Azure, AWS, or any SaaS vendor), power outages, or Force Majeure events is excluded from the Uptime SLA calculation.

ARTICLE 3 — TERM, TRIAL, AND RENEWAL

3.1 Effective Date. This Agreement becomes effective when Customer electronically submits the enrollment form on Provider’s website. The Effective Date is the date of submission.

3.2 Free Trial Period. Customer shall have seven (7) calendar days from the Effective Date to evaluate the full Exclusive-level Services at no cost. During the Free Trial Period, all services listed in Section 2.1 are fully active, including 24/7 monitoring, the Full Cybersecurity Stack, cloud management, backup management, the Dedicated IT Manager, and the Executive Dashboard. The Free Trial Period ends at 11:59 PM on the seventh (7th) calendar day.

3.3 Opt-Out During Trial. To cancel during the Free Trial Period, Customer must provide written notice via email to support@myonetech.com before the expiration of the seventh (7th) day. No fee, charge, or obligation of any kind shall be incurred if proper notice is given. Provider will cease all Services within one (1) Business Day of receiving cancellation notice.

3.4 Automatic Conversion. If Customer does not provide written cancellation notice before the Free Trial Period expires, this Agreement automatically converts to a binding contract effective the eighth (8th) calendar day, and the Initial Term begins. Customer’s first invoice will be generated for the current calendar month (prorated from the 8th day through month-end).

3.5 Initial Term. The Initial Term is twelve (12) consecutive Service Periods. The plan is billed month-to-month at $999.00 USD per site per month.

3.6 Renewal. Upon completion of the Initial Term, this Agreement automatically renews on a month-to-month basis (each Renewal Term) until terminated by either Party in accordance with Article 5.

3.7 Price Changes. Provider may adjust the monthly fee with sixty (60) days’ prior written notice to Customer. If Customer does not accept the new fee, Customer may terminate at the end of the then-current Service Period without ETF (this is the only circumstance in which early termination is permitted without ETF during the Initial Term).

ARTICLE 4 — FEES AND PAYMENT

4.1 Monthly Fee. Customer shall pay Provider $999.00 USD per site per month for the Services. The fee is non-refundable once the applicable Service Period begins.

4.2 Billing Cycle. Invoices are issued on the 1st of each calendar month for that month’s Service Period. The first invoice (if the Effective Date falls mid-month) is prorated.

4.3 Payment Methods. Payment is accepted via ACH bank transfer, personal or business check, or major credit card. Payment is due within ten (10) calendar days of invoice date.

4.4 Late Payment. Overdue amounts accrue a finance charge of 1.5% per month (18% per annum) on the outstanding balance, or the maximum rate permitted by New Mexico law, whichever is less. Provider may suspend Services after fifteen (15) days of non-payment upon five (5) days’ prior written notice. Provider may resume Services upon receipt of payment in full, including any late charges.

4.5 Taxes. All fees are exclusive of applicable federal, state, and local taxes. Customer is responsible for all sales tax, use tax, or other governmental charges arising from the Services.

4.6 Collection Costs. If any amount becomes more than thirty (30) days past due, Customer shall pay all reasonable costs of collection, including but not limited to reasonable attorney’s fees, court costs, and collection agency fees, to the extent permitted by New Mexico law.

4.7 No Set-Off. Customer may not withhold, deduct, or set off any amount from fees due to Provider, regardless of any claim, dispute, or perceived deficiency in the Services.

4.8 Price Increases. As stated in Section 3.7, Provider may increase fees with 60 days’ notice.

4.9 Cloud & Third-Party Costs. Customer is solely responsible for the underlying subscription and licensing costs of Microsoft 365, Azure, and any other third-party SaaS or cloud services. Provider manages the administrative and security configuration of these environments but does not absorb the subscription fees.

ARTICLE 5 — CANCELLATION AND TERMINATION

5.1 During Free Trial. As stated in Section 3.3, Customer may cancel without obligation during the 7-day Free Trial Period.

5.2 During Initial Term — Customer Cancellation. If Customer cancels or terminates this Agreement for any reason during the Initial Term (after the Free Trial Period), Customer shall pay the Early Termination Fee (ETF), which equals the sum of all remaining monthly fees through the end of the Initial Term. For example, if Customer cancels at the end of month 4, the ETF equals 8 × $999.00 = $7,992.00.

5.3 During Initial Term — Provider Termination for Cause. Provider may terminate this Agreement immediately upon written notice if Customer: (a) fails to pay any amount within fifteen (15) days of the due date and fails to cure within an additional five (5) days of written notice; (b) uses the Services for any unlawful purpose; (c) materially breaches any provision of this Agreement and fails to cure within ten (10) days of written notice; or (d) becomes insolvent, files for bankruptcy, or has a receiver appointed. In the event of Provider termination for cause under this Section 5.3, Customer is not required to pay the ETF for the remaining term, but Customer remains liable for all fees accrued through the termination date.

5.4 During Initial Term — Customer Termination for Cause. Customer may terminate this Agreement during the Initial Term without ETF if Provider: (a) fails to meet SLA targets (including the Uptime SLA) for three (3) consecutive Service Periods without cure; (b) materially breaches this Agreement and fails to cure within thirty (30) days of written notice; or (c) ceases operations or becomes unable to perform. In such cases, Provider shall refund all prepaid fees for the remainder of the Initial Term on a pro-rata basis within thirty (30) days.

5.5 During Renewal Term. After the Initial Term, either Party may terminate this Agreement with thirty (30) days’ prior written notice. No ETF applies during Renewal Terms.

5.6 Effect of Termination. Upon termination or expiration: (a) Customer’s right to receive Services ceases immediately; (b) Customer shall pay all fees accrued through the termination date, plus any applicable ETF; (c) Provider shall, within fourteen (14) days of termination, export and deliver to Customer all monitoring logs, security reports, backup configurations, cloud administration documentation, quarterly strategy session reports, executive dashboard data exports, project documentation, ticket history, and other records generated by Provider during the Service Period at no additional charge; (d) Provider shall transition or assist with transition of Customer’s Cloud Environments to Customer or a successor provider for up to thirty (30) days at no additional charge; (e) the Dedicated IT Manager shall provide a full handoff briefing to Customer or the successor provider; and (f) all provisions of this Agreement that by their nature survive termination (including Articles 7, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, and 30) shall survive.

5.7 No Refunds Except as Stated. Except for the Free Trial Period, the specific circumstance in Section 3.7, and Customer termination for cause under Section 5.4, no fees are refundable under any circumstances, including but not limited to early termination, service interruption, or Customer’s change of business.

ARTICLE 6 — SERVICE LEVEL AGREEMENT (SLA)

6.1 Response Times and Targets.

Metric	Target
First response to Ticket (24/7)	Within 15 minutes
Remote resolution (standard issues)	Within 4 Business Hours
Critical Incident resolution	Within 4 hours (24/7)
On-Site Visit scheduling (all)	Same day (guaranteed)
Backup verification	Weekly automated; test-restore monthly
Patch deployment (critical security)	Within 14 days of vendor release
Quarterly IT Strategy Session delivery	Within 5 Business Days of quarter end
Monthly Executive Report delivery	Within 5 Business Days of month-end
Annual IT Budget Plan delivery	Within 10 Business Days of planning session
Uptime (monthly)	99.9%

6.2 SLA Credits. If Provider fails to meet the targets in Section 6.1, Customer is entitled to the following credits applied to the following month’s invoice:

Missed Metric	Credit
First response > 15 minutes	20% of monthly fee
Remote resolution > 4 Business Hours	10% of monthly fee
Critical Incident not resolved within 4 hours	20% of monthly fee
On-Site Visit not performed same day	25% of monthly fee
Backup verification or test-restore not completed	5% of monthly fee
Critical patch not deployed within 14 days	5% of monthly fee
Quarterly Strategy Session not delivered within 5 Business Days	10% of monthly fee
Monthly Executive Report not delivered within 5 Business Days	5% of monthly fee
Uptime below 99.9% (see Section 6.7)	Per Section 6.7 schedule

6.3 Maximum Credits. Total SLA credits in any single Service Period shall not exceed fifty percent (50%) of the monthly fee.

6.4 Sole Remedy. SLA credits are Customer’s sole and exclusive remedy for Provider’s failure to meet the targets in Section 6.1, except as provided in Section 5.4 (Customer termination for cause after three consecutive missed months). Customer waives all other claims, damages, or remedies related to response time, resolution time, or availability, whether in contract, tort, or otherwise.

6.5 Exclusions. The SLA does not apply to: (a) issues caused by Customer’s hardware, software, or configuration; (b) outages of Customer’s internet service provider, telephone carrier, or any third-party service; (c) Microsoft, Azure, AWS, or other SaaS platform outages; (d) scheduled maintenance for which Provider gave 48 hours’ prior notice; (e) Force Majeure events; (f) issues requiring Customer’s cooperation, access, or credentials that Customer failed to provide in a timely manner; (g) Out-of-Scope Work; or (h) periods during which Services are suspended due to non-payment under Section 4.4.

6.6 Claim Process. To claim an SLA credit, Customer must submit a written request via email to support@myonetech.com within ten (10) calendar days of the missed target, specifying the Ticket number, the metric missed, and the date/time of the event. Provider will respond within five (5) Business Days. If not claimed within 10 days, the credit is forfeited.

6.7 Uptime SLA (99.9%).

(a) Definition. “Uptime” means the percentage of time during a calendar month that Customer’s managed infrastructure (servers, network, and cloud environments managed by Provider) is available and operational, excluding excluded downtime as defined in Section 6.5.

(b) Target. Provider guarantees 99.9% monthly uptime, which permits a maximum of approximately 43 minutes of excluded downtime per month.

(c) Measurement. Uptime is measured continuously by Provider’s monitoring systems. Customer may request uptime reports at any time.

(d) Credit Schedule.

Monthly Uptime	Credit (% of Monthly Fee)
99.0% – 99.89%	15%
98.0% – 98.99%	30%
97.0% – 97.99%	45%
Below 97.0%	50%

(e) Cumulative Failure. If uptime falls below 99.0% for three (3) consecutive months, Customer may terminate under Section 5.4 without ETF.

(f) Excluded Downtime. The following do not count against the Uptime SLA: (i) scheduled maintenance with 48 hours’ prior notice; (ii) third-party outages (ISP, Microsoft, Azure, AWS, SaaS vendors); (iii) Customer-caused issues; (iv) Force Majeure events; and (v) periods of non-payment suspension.

ARTICLE 7 — DATA RESPONSIBILITY AND BACKUP

7.1 Provider-Managed Backups. As part of the Services, Provider shall configure, deploy, and manage automated backup solutions for Customer’s critical systems and Data. Provider shall perform verified restore testing at least monthly and document results. Provider shall maintain backup infrastructure in accordance with the RPO and RTO targets agreed upon during onboarding.

7.2 Customer’s Underlying Responsibility. Notwithstanding Provider’s backup management, Customer acknowledges that: (a) Customer retains ultimate ownership and responsibility for its Data; (b) Customer shall notify Provider of any new critical data sources that require backup coverage; (c) Customer shall not delete or modify backup configurations without Provider’s approval; and (d) Customer is responsible for ensuring that its Data does not violate any law, regulation, or third-party right.

7.3 No Absolute Guarantee of Recovery. Provider shall use commercially reasonable efforts to ensure Data integrity and recoverability through the backup and DR programs. However, Provider shall not be liable under any theory of law — including but not limited to contract, negligence, strict liability, or breach of warranty — for any loss, corruption, alteration, deletion, or destruction of Data that is not the result of Provider’s gross negligence or willful misconduct. This includes losses caused by: ransomware or zero-day exploits that bypass the Full Cybersecurity Stack; hardware failure of backup media; Customer’s own actions or inactions; or events beyond Provider’s reasonable control.

7.4 DR Testing. Provider shall perform and document a full disaster recovery test at least annually, and a partial restore test at least monthly. Results shall be included in the quarterly IT strategy session report. If a test reveals a failure to meet agreed RPO/RTO targets, Provider shall remediate within fifteen (15) Business Days.

7.5 Data Return and Deletion. Upon termination, Provider shall: (a) export and deliver to Customer all Data, backup configurations, and documentation within fourteen (14) days; (b) provide transition assistance for up to thirty (30) days at no charge; and (c) after the transition period, securely delete all Customer Data from Provider’s systems within thirty (30) days, except as required by law.

7.6 Customer’s Warranties Regarding Data. Customer represents and warrants that: (a) Customer has the legal right to possess and use all Data on Customer’s systems and in Customer’s Cloud Environments; (b) Customer’s Data does not and will not violate any law, regulation, or third-party right; and (c) Customer will promptly notify Provider of any suspected Data breach or corruption.

ARTICLE 8 — BEST-EFFORTS SERVICE AND WARRANTY

8.1 Best Efforts. All Services are provided on a best-efforts basis. Provider uses skilled, experienced technicians and follows industry-standard practices (NIST Cybersecurity Framework, CIS Controls, ITIL service management). However, Provider does not guarantee: (a) that all issues will be resolved; (b) any specific resolution time beyond the SLA in Article 6; (c) that components will be immediately available; (d) that a repair will be permanent; (e) compatibility between existing and new components; (f) that Customer’s systems will be free from errors, vulnerabilities, or downtime beyond the Uptime SLA; or (g) that the Full Cybersecurity Stack will prevent all security incidents.

8.2 Parts and Labor Warranty. Provider warrants parts ninety (90) days and labor performed by Provider for thirty (30) days from the date of service completion. This warranty: (a) covers only the specific part replaced or work performed; (b) does not cover damage caused by misuse, liquid exposure, physical impact, electrical surge, unauthorized modification by Customer or a third party, or failure to follow Provider’s written care instructions; (c) is void if the equipment is serviced by a party other than Provider after the initial repair without Provider’s consent; and (d) is the sole warranty provided, express or implied.

8.3 Disclaimer of Implied Warranties. TO THE MAXIMUM EXTENT PERMITTED BY NEW MEXICO LAW, PROVIDER DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. PROVIDER MAKES NO WARRANTY THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE.

8.4 No Obligation to Repair. Provider is under no obligation to repair, replace, or refund for: (a) hardware that is obsolete, end-of-life, or beyond economical repair; (b) damage caused by Customer or a third party; (c) issues arising from Customer’s failure to follow Provider’s recommendations; or (d) problems that Customer’s own staff or a previous provider caused.

ARTICLE 9 — COST AUTHORIZATION AND SCOPE CONTROL

9.1 Authorization Threshold. Customer authorizes Provider to perform all in-scope work as described in Section 2.1 up to the monthly fee of $999.00 per site. If additional issues are discovered during service that would increase the total cost by more than fifteen percent (15%) of the original quote for a specific out-of-scope job, Provider shall contact Customer for written approval before proceeding with the additional work.

9.2 On-Site Time Limit. Each On-Site Visit includes up to four (4) hours of work at no additional charge. Provider will notify Customer before exceeding four hours. Additional time beyond four (4) hours per visit is billed at $85/hour with Customer’s prior verbal or written approval.

9.3 No Unauthorized Work. Provider shall not perform Out-of-Scope Work without Customer’s prior written authorization. Any work performed without authorization is at Provider’s sole expense and Customer owes nothing for it.

9.4 Customer’s Duty to Cooperate. Customer shall provide reasonable cooperation, access, and information necessary for Provider to perform the Services, including: (a) physical and logical access to all managed systems; (b) current administrator credentials for Cloud Environments and on-premises infrastructure; (c) a designated point of contact available for time-sensitive decisions; and (d) timely approval for scheduled maintenance windows. If Customer fails to provide access, credentials, or a point of contact within a reasonable time (four (4) hours for Critical Incidents; one (1) Business Day for standard issues), the SLA clock is paused until Customer responds.

9.5 Hardware and Software (Preferred Pricing). Hardware and software purchases are provided at Preferred Pricing as described in Section 2.1(l). Licensing is passed through at list price or negotiated discount, whichever is lower. Provider shall always recommend the most cost-effective option and provide at least two alternatives when a purchase exceeds $500.

ARTICLE 10 — ON-SITE SERVICE TERMS

10.1 Customer’s Obligations. For each On-Site Visit, Customer shall: (a) provide safe, secure, and unobstructed access to the work area; (b) provide adequate power outlets and a stable working environment; (c) have a designated point of contact available for the duration of the visit; (d) provide existing network documentation, administrator credentials, or physical keys as reasonably necessary; and (e) ensure that no hazardous conditions (exposed wiring, water, chemicals, animals) are present in the work area.

10.2 Provider Not Liable for Pre-Existing Conditions. Provider shall not be liable for any damage to Customer’s property, equipment, or premises discovered during an On-Site Visit that is attributable to pre-existing conditions, including but not limited to: power instability or surges; water or moisture damage; pest damage; structural deficiencies; prior unauthorized modifications; or wear and tear.

10.3 Scheduling and Travel. All On-Site Visits are scheduled with a guaranteed same-day response. Standard requests received before 12:00 PM shall be serviced the same day. Requests received after 12:00 PM shall be serviced the same day if feasible or by 8:00 AM the following business day (which still constitutes same-day scheduling under this Agreement). Provider is not obligated to travel more than fifty (50) miles from its Deming, NM location without prior written agreement on additional travel charges.

10.4 Unlimited Visits — Reasonable Use. While On-Site Visits are unlimited in number, Customer agrees to use them in a reasonable and good-faith manner consistent with the Services. Provider may discuss usage patterns with Customer during the quarterly IT strategy session if visit frequency appears inconsistent with the scope of the Services.

ARTICLE 11 — SOFTWARE, LICENSING, AND COMPLIANCE

11.1 Customer’s Responsibility for Licenses. Customer is solely responsible for owning, maintaining, and renewing valid licenses for all operating systems, applications, and software running on Customer’s devices, infrastructure, and Cloud Environments. Provider does not supply, activate, renew, or warrant the legality of any pre-existing software.

11.2 No Piracy. Customer represents and warrants that all software installed on Customer’s systems is properly licensed. Customer shall not request, and Provider shall not perform, any service that would facilitate software piracy, license evasion, or violation of any end-user license agreement.

11.3 Cloud Licensing. For Microsoft 365, Azure, and other SaaS services managed under this Agreement, Customer is responsible for the underlying subscription and licensing costs. Provider manages the administrative, security, and optimization configuration of these environments.

11.4 Compliance. Customer is solely responsible for ensuring that its business operations, use of technology, and handling of Data comply with all applicable federal, state, and local laws and regulations, including but not limited to HIPAA, PCI-DSS, COPPA, FERPA, and any industry-specific requirements. Provider may recommend and implement technical compliance controls but is not a legal, compliance, or regulatory advisor.

11.5 Provider’s Right to Refuse. Provider may refuse to perform any service that Provider reasonably believes would violate applicable law, facilitate unauthorized access to any system, or expose Provider to legal liability.

ARTICLE 12 — SECURITY AND CONFIDENTIALITY

12.1 Reasonable Safeguards. Provider shall implement and maintain the Full Cybersecurity Stack and additional reasonable administrative, technical, and physical safeguards to protect Customer’s Confidential Information and systems from unauthorized access, use, or disclosure. Security controls are consistent with the NIST Cybersecurity Framework and CIS Controls v8 for organizations of similar size and risk profile.

12.2 No Absolute Security. Provider acknowledges that no system is completely secure. The Full Cybersecurity Stack significantly reduces risk but does not eliminate it. Provider does not guarantee that Customer’s systems, networks, or Data will be free from intrusion, attack, vulnerability, or compromise. Customer acknowledges the inherent risk of operating in a connected digital environment and accepts that risk.

12.3 Confidentiality Obligation. Each Party shall hold the other’s Confidential Information in strict confidence and shall not disclose it to third parties without prior written consent, except: (a) as required by law, regulation, or court order; (b) to Provider’s employees, agents, or subcontractors who need to know and are bound by equivalent confidentiality obligations; or (c) as necessary to enforce this Agreement.

12.4 Survival. The confidentiality obligations in this Article survive termination of this Agreement for a period of two (2) years.

12.5 Security Incident Notification. In the event Provider becomes aware of a security incident affecting Customer’s Data, systems, or Cloud Environments, Provider shall: (a) notify Customer within two (2) hours of detection; (b) initiate its incident response plan immediately; (c) provide a written incident report (including timeline, root cause, impact assessment, and remediation steps) within five (5) Business Days; and (d) cooperate fully with Customer in investigating and remediating the incident. Provider’s liability for any incident is subject to the limitations in Article 14.

12.6 Customer’s Security Responsibilities. Customer is responsible for: (a) maintaining strong passwords and enabling MFA on all accounts (Provider will enforce MFA on managed systems); (b) not sharing credentials with unauthorized individuals; (c) promptly reporting suspected security incidents to Provider (target: within 1 hour of discovery); (d) not installing unauthorized software on managed Endpoints; (e) completing security awareness training when scheduled by Provider; and (f) physically securing all hardware and access points.

12.7 Security Reporting. Provider shall include a security summary in each monthly executive report and quarterly IT strategy session report, covering: incidents and near-misses, patch compliance, vulnerability scan results, MFA adoption status, email security metrics, and any changes to the security posture.

ARTICLE 13 — CUSTOMER REPRESENTATIONS AND WARRANTIES

Customer represents, warrants, and covenants that:

13.1 Customer is at least eighteen (18) years of age and has the legal capacity to enter into this Agreement.

13.2 If Customer is an entity, the individual enrolling has actual authority to bind that entity to this Agreement.

13.3 Customer’s enrollment in and use of the Services will comply with all applicable federal, state, and local laws and regulations.

13.4 Customer owns or has the legal right to use all hardware, software, and Data on its systems and in its Cloud Environments.

13.5 Customer has implemented or will implement its own independent backup solution in addition to the Provider-managed backups, or has accepted Provider’s backup management as its primary backup strategy in writing.

13.6 Customer will not use the Services for any unlawful purpose, including but not limited to: hacking, unauthorized access to any computer system, distribution of malware, spam, fraud, or any activity that violates the Computer Fraud and Abuse Act (18 U.S.C. § 1030) or New Mexico’s computer crimes statutes (NMSA 1978, § 30-22-1 et seq.).

13.7 Customer is not currently the subject of any bankruptcy, insolvency, or receivership proceeding.

13.8 Customer’s enrollment information (name, address, email, phone) is accurate and current.

13.9 Customer shall notify Provider within five (5) Business Days of any material change in its IT environment, including new sites, significant hardware additions, changes in cloud subscription, or changes in data sensitivity classification.

ARTICLE 14 — LIMITATION OF LIABILITY

THIS ARTICLE IS A MATERIAL TERM OF THIS AGREEMENT. BY ENROLLING, CUSTOMER EXPRESSLY ACKNOWLEDGES AND AGREES TO THE LIMITATIONS BELOW.

14.1 NO CONSEQUENTIAL DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE NEW MEXICO LAW, IN NO EVENT SHALL PROVIDER BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES OF ANY KIND, INCLUDING BUT NOT LIMITED TO: LOSS OF BUSINESS; LOSS OF PROFITS; LOSS OF REVENUE; LOSS OF DATA; LOSS OF GOODWILL; LOSS OF PRODUCTION SAVINGS; LOSS OF USE; BUSINESS INTERRUPTION; COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; OR DAMAGES FOR LITIGATION, ARBITRATION, OR DISPUTE RESOLUTION. THIS LIMITATION APPLIES REGARDLESS OF THE CAUSE OF ACTION OR THEORY OF LIABILITY, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, AND REGARDLESS OF WHETHER PROVIDER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

14.2 CAP ON LIABILITY. NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS AGREEMENT OR AT LAW, PROVIDER’S TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THIS AGREEMENT, THE SERVICES, OR ANY DELIVERY OF SERVICES, WHETHER IN CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR OTHERWISE, SHALL NOT EXCEED THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER TO PROVIDER IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. IN NO EVENT SHALL PROVIDER’S LIABILITY EXCEED $11,988.00 (TWELVE MONTHS OF THE MONTHLY FEE OF $999.00).

14.3 EXCLUSIONS FROM CAP. The limitations in Sections 14.1 and 14.2 do not apply to: (a) Customer’s payment obligations under this Agreement; (b) Provider’s indemnification obligations under Article 15 (to the extent Provider is the indemnifying party); (c) Provider’s gross negligence or willful misconduct; or (d) liability that cannot be limited under applicable New Mexico law.

14.4 NO LIABILITY FOR THIRD PARTIES. Provider shall not be liable for any acts, omissions, errors, or failures of any third party, including but not limited to: Customer’s internet service provider; telephone or cable carriers; Microsoft, Azure, AWS, Google, or any SaaS vendor; hardware manufacturers; software vendors; or any other entity not directly employed by Provider.

14.5 NO LIABILITY FOR CUSTOMER’S ACTS. Provider shall not be liable for any loss or damage resulting from: Customer’s failure to follow Provider’s written instructions or recommendations; Customer’s own negligence or mismanagement; acts or omissions of Customer’s employees, agents, or contractors; Customer’s failure to maintain adequate backups beyond what Provider manages; Customer’s unauthorized modification of managed systems; or Customer’s failure to report a security incident in a timely manner.

14.6 ACKNOWLEDGMENT. Customer acknowledges that: (a) the limitations in this Article are a material inducement for Provider to offer the Services at the stated price; (b) without these limitations, Provider would not provide the Services or would charge substantially more; and (c) Customer has had the opportunity to seek independent legal counsel before enrolling.

ARTICLE 15 — INDEMNIFICATION

15.1 Customer Indemnifies Provider. Customer shall indemnify, defend, and hold harmless Provider, its members, managers, employees, agents, officers, directors, successors, and assigns (collectively, “Provider Indemnitees”) from and against any and all claims, demands, actions, suits, losses, liabilities, damages, costs, and expenses (including reasonable attorney’s fees and court costs) arising out of or relating to:

(a) Customer’s use of the Services, including any use not in accordance with this Agreement;
(b) Customer’s violation of any applicable law, regulation, or third-party right;
(c) Any claim that Customer’s Data, hardware, software, or Cloud Environments infringe a third party’s intellectual property or other rights;
(d) Any claim by Customer’s employees, agents, or contractors related to the Services;
(e) Customer’s breach of this Agreement;
(f) Any claim arising from Customer’s failure to maintain adequate backups or to follow Provider’s security recommendations;
(g) Any claim arising from Customer’s unlawful use of the Services or any system;
(h) Any tax, penalty, or fine imposed on Provider as a result of Customer’s actions or omissions; or
(i) Any claim arising from Customer’s content, data, or materials hosted in its Cloud Environments.

15.2 Provider Indemnifies Customer (Limited). Provider shall indemnify and hold harmless Customer from and against any third-party claim that Provider’s Services, as performed in accordance with this Agreement, infringe a third party’s patent, copyright, or trademark, provided that: (a) Customer promptly notifies Provider in writing of the claim; (b) Provider has sole control of the defense and settlement; and (c) Customer provides reasonable cooperation at Provider’s expense. Provider’s sole obligation under this Section is to procure the right for Customer to continue using the infringing element, modify it, or replace it with a non-infringing equivalent. Provider’s total liability under this Section is subject to the cap in Section 14.2.

15.3 Exclusions from Provider Indemnification. Provider’s indemnification in Section 15.2 does not apply to claims arising from: (a) Customer’s modification of the Services; (b) combination of the Services with hardware, software, or data not provided by Provider; (c) Customer’s use of the Services in a manner not recommended by Provider; (d) any open-source software included at Customer’s request; or (e) Customer’s Cloud Environments or third-party SaaS platforms.

ARTICLE 16 — INTELLECTUAL PROPERTY

16.1 Provider’s IP. All methodologies, scripts, monitoring tools, dashboards, security playbooks, incident response plans, documentation templates, proprietary processes, trade secrets, and other intellectual property used by Provider in delivering the Services are and shall remain the sole and exclusive property of Provider. Nothing in this Agreement grants Customer any right, title, or interest in Provider’s intellectual property.

16.2 Customer’s IP. All Data, documents, business content, and intellectual property owned by Customer remain the sole property of Customer. Provider acquires no right, title, or interest in Customer’s Data except the limited right to process, monitor, back up, and manage it as necessary to deliver the Services.

16.3 Reports and Plans. Reports, assessments, roadmaps, Annual IT Budget Plans, and strategy documents generated by Provider specifically for Customer under this Agreement are the property of Customer and may be used by Customer for internal business purposes.

16.4 Feedback. If Customer provides suggestions, ideas, or feedback regarding the Services, Provider may use them without obligation or compensation to Customer.

ARTICLE 17 — INDEPENDENT CONTRACTOR

17.1 Provider is an independent contractor. Nothing in this Agreement creates a partnership, joint venture, agency, employment, or fiduciary relationship between the Parties.

17.2 Provider is not an employee of Customer and has no authority to bind Customer to any obligation. Customer is not an employee of Provider. The Dedicated IT Manager is an employee or contractor of Provider and not of Customer.

17.3 Each Party is solely responsible for its own taxes, insurance, and employment obligations.

ARTICLE 18 — FORCE MAJEURE

18.1 Neither Party shall be liable for any failure or delay in performing its obligations under this Agreement (other than payment obligations) to the extent caused by events beyond its reasonable control, including but not limited to: acts of God; natural disasters (flood, earthquake, wildfire, tornado); war; terrorism; civil unrest; government action or order; pandemic or epidemic; labor strike; fire; explosion; widespread internet or telecommunications failure; power grid failure; or failure of a third-party service provider on which Provider relies (including Microsoft, Azure, or major cloud infrastructure providers).

18.2 The affected Party shall: (a) notify the other Party within twenty-four (24) hours of the Force Majeure event; (b) use commercially reasonable efforts to mitigate the impact and resume performance; and (c) provide regular updates on the expected duration.

18.3 If a Force Majeure event continues for more than thirty (30) consecutive days, either Party may terminate this Agreement upon written notice without ETF, and Customer shall pay only for Services actually rendered through the termination date.

ARTICLE 19 — DISPUTE RESOLUTION AND GOVERNING LAW

19.1 Governing Law. This Agreement shall be governed by, construed, and enforced in accordance with the laws of the State of New Mexico, without regard to its conflict of laws principles. The United Nations Convention on Contracts for the International Sale of Goods is expressly excluded.

19.2 Good-Faith Negotiation. The Parties shall first attempt to resolve any dispute arising out of or relating to this Agreement through good-faith negotiation. A designated representative from each Party (for Customer, the Dedicated IT Manager or Customer’s leadership; for Provider, the Provider’s managing member or designee) shall meet (in person or by video conference) within fifteen (15) days of written notice of a dispute.

19.3 Binding Arbitration. If the dispute is not resolved through negotiation within thirty (30) days, it shall be submitted to binding arbitration administered by the American Arbitration Association (AAA) under its Commercial Arbitration Rules. The arbitration shall take place in Las Cruces, New Mexico. The arbitrator’s decision shall be final and binding and may be entered as a judgment in any court of competent jurisdiction.

19.4 Attorney’s Fees. The prevailing Party in any arbitration or court proceeding shall be entitled to recover its reasonable attorney’s fees, expert witness fees, and costs from the non-prevailing Party.

19.5 Injunctive Relief. Notwithstanding the arbitration clause, either Party may seek temporary or preliminary injunctive relief in the state or federal courts located in Doña Ana County, New Mexico, to prevent irreparable harm, including but not limited to unauthorized disclosure of Confidential Information or unauthorized use of intellectual property.

19.6 WAIVER OF JURY TRIAL. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EACH PARTY HEREBY KNOWINGLY, VOLUNTARILY, AND IRREVOCABLY WAIVES ANY RIGHT TO A TRIAL BY JURY IN ANY LEGAL PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT. THE PARTIES ACKNOWLEDGE THAT THIS WAIVER IS A MATERIAL INDUCEMENT FOR ENTERING INTO THIS AGREEMENT.

19.7 Class Action Waiver. TO THE EXTENT PERMITTED BY LAW, EACH PARTY WAIVES THE RIGHT TO PARTICIPATE AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS ACTION, COLLECTIVE ACTION, OR CONSOLIDATED ACTION ARISING OUT OF OR RELATING TO THIS AGREEMENT. ANY DISPUTE SHALL BE RESOLVED ON AN INDIVIDUAL BASIS ONLY.

19.8 Small Claims. Notwithstanding the arbitration clause, either Party may elect to pursue a claim in small claims court in Doña Ana County, New Mexico, for amounts within the jurisdictional limit, in lieu of arbitration.

ARTICLE 20 — ASSIGNMENT AND SUBCONTRACTING

20.1 Customer May Not Assign. Customer shall not assign, transfer, or delegate this Agreement or any rights or obligations hereunder without Provider’s prior written consent, which may be granted or withheld in Provider’s sole discretion. Any purported assignment without consent is void.

20.2 Change of Ownership. A sale, merger, or change of majority ownership of Customer’s business constitutes a change of entity and requires Provider’s written consent to continue the Agreement. Without consent, the Agreement terminates and the ETF applies.

20.3 Provider May Subcontract. Provider may subcontract portions of the Services to trusted third-party technicians, security specialists, or cloud engineers, provided that: (a) Provider remains fully responsible for the quality and confidentiality of all work; (b) subcontractors are bound by confidentiality obligations no less restrictive than this Agreement; (c) Customer is notified of any subcontractor with access to their systems or Data; and (d) Customer is not required to consent to any subcontractor. The Dedicated IT Manager role may not be subcontracted.

ARTICLE 21 — NOTICES

21.1 All notices under this Agreement must be in writing and are deemed effectively given when: (a) delivered personally; (b) sent by confirmed email (with read receipt or return confirmation) to the email address provided in the enrollment form; (c) sent by certified mail, return receipt requested, to the address on file; or (d) sent by nationally recognized overnight courier.

21.2 Provider’s Address: 5830 Franklin Rd SE, Deming, NM 88030. Email: support@myonetech.com.

21.3 Customer’s Address: As provided in the enrollment form. Customer shall notify Provider within five (5) Business Days of any change of address.

21.4 Notices of cancellation, termination, or breach must be sent via email AND certified mail to be effective.

21.5 Security Incident Notices. Notices under Section 12.5 (Security Incident Notification) are effective upon email delivery and do not require certified mail.

ARTICLE 22 — RECORDS AND AUDIT

22.1 Provider shall maintain records of all Tickets, On-Site Visits, patch deployments, security events, backup tests, cloud changes, maintenance activities, project milestones, and strategy session notes for a minimum of twenty-four (24) months.

22.2 Quarterly Strategy Reports. Provider shall deliver a written quarterly IT strategy session report to Customer within five (5) Business Days of each strategy session, as described in Section 2.1(j).

22.3 Monthly Executive Reports. Provider shall deliver a written monthly executive report to Customer within five (5) Business Days of month-end, as described in Section 2.1(k).

22.4 Service Reports. Customer may request an additional service report at any time. Provider shall provide a summary of Tickets, resolutions, On-Site Visits, security events, and project status within five (5) Business Days of request.

22.5 Monitoring Access. Customer has ongoing access to the Executive Dashboard as described in Section 2.1(k). Provider is not obligated to provide real-time access to its internal administrative tools or to grant Customer administrative access to Provider’s management platform beyond the Executive Dashboard.

ARTICLE 23 — PROVIDER’S RIGHTS AND REMEDIES

23.1 Right to Suspend. Provider may suspend or terminate Services immediately (without notice) if: (a) Customer uses the Services for unlawful purposes; (b) Customer’s systems pose a security threat to Provider’s network, monitoring infrastructure, or other customers; (c) Customer fails to pay and the cure period in Section 4.4 has expired; or (d) Provider reasonably believes continued service would expose Provider to legal liability.

23.2 Right to Refuse. Provider may refuse to perform any specific service or Ticket that Provider reasonably determines is: (a) out of scope; (b) unsafe; (c) likely to cause damage; (d) in violation of law; or (e) beyond Provider’s technical capability.

23.3 Right to Modify Services. Provider reserves the right to modify, upgrade, or discontinue specific tools, platforms, or methodologies used in delivering the Services, provided the overall scope and quality of the Services is maintained and no material reduction in service level occurs. Provider shall notify Customer of material changes at least thirty (30) days in advance.

23.4 No Duty to Train Beyond Scope. Provider shall provide annual security awareness training as part of the Full Cybersecurity Stack. Beyond that, Provider has no obligation to provide ongoing IT literacy instruction, educational programs, or staff training not specifically requested and approved as Out-of-Scope Work.

23.5 Right to Access. Customer grants Provider ongoing remote and physical access to all managed systems, Endpoints, network devices, and Cloud Environments for the purpose of delivering the Services. Customer shall not revoke such access without providing thirty (30) days’ written notice and a transition plan.

ARTICLE 24 — ELECTRONIC SIGNATURE AND RECORDS

24.1 Electronic Signature. Customer acknowledges and agrees that the electronic submission of the enrollment form on Provider’s website constitutes a legally binding electronic signature under: (a) the federal ESIGN Act (15 U.S.C. § 7001 et seq.); (b) the New Mexico Uniform Electronic Transactions Act (NMSA 1978, § 14-16-1 et seq.); and (c) the New Mexico UETA. This electronic signature is the legal equivalent of a handwritten signature.

24.2 Acknowledgment of Understanding. By submitting the enrollment form, Customer represents that: (a) Customer has read this entire Agreement in its entirety; (b) Customer understands all terms, conditions, and limitations; (c) Customer has had the opportunity to consult with independent legal counsel; (d) Customer enters into this Agreement voluntarily and without duress; (e) Customer is bound by all terms as if physically signed; and (f) Customer specifically acknowledges the 12-month binding term, the ETF, the liability cap in Section 14.2, the data responsibility provisions in Article 7, the 99.9% Uptime SLA in Section 6.7, and the Dedicated IT Manager assignment.

24.3 Electronic Records. The Parties agree that electronic records and communications (including email confirmations, ticket logs, monitoring data, and Executive Dashboard data) are valid and admissible in any proceeding to the same extent as paper records under NMSA 1978, § 14-16-5.

ARTICLE 25 — SEVERABILITY

25.1 If any provision of this Agreement is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, that provision shall be modified to the minimum extent necessary to make it valid and enforceable, or if it cannot be modified, it shall be severed and the remaining provisions shall continue in full force and effect.

25.2 The invalidity of any provision does not affect the validity of the remaining provisions or the Agreement as a whole.

ARTICLE 26 — WAIVER

26.1 The failure of either Party to enforce any provision of this Agreement shall not constitute a waiver of that Party’s right to enforce that provision or any other provision in the future.

26.2 A waiver of any breach must be in writing and signed by the waiving Party to be effective.

26.3 No course of dealing or pattern of conduct shall constitute a waiver of any term of this Agreement.

ARTICLE 27 — ENTIRE AGREEMENT AND AMENDMENTS

27.1 Entire Agreement. This Agreement, together with the service description published on Provider’s website for the Exclusive Membership Plan at the time of enrollment, constitutes the entire agreement between the Parties regarding the subject matter hereof. It supersedes all prior or contemporaneous negotiations, representations, warranties, commitments, offers, or agreements, whether written or oral.

27.2 No Oral Modifications. No modification, amendment, or supplement to this Agreement is valid unless made in writing and signed (or electronically acknowledged) by both Parties. No representative, employee, or agent of either Party has authority to modify this Agreement except as expressly provided herein.

27.3 No Reliance. Customer acknowledges that it has not relied on any representations, statements, or promises made by Provider (or its agents) other than those expressly set forth in this Agreement.

27.4 Acceptable Use Policy. Customer agrees to comply with Provider’s Acceptable Use Policy (AUP), which is incorporated herein by reference. A copy is available at myonetech.com/acceptable-use-policy-aup/.

ARTICLE 28 — COMPLIANCE WITH LAWS

28.1 Each Party shall comply with all applicable federal, state, and local laws, regulations, and ordinances in the performance of this Agreement.

28.2 Customer specifically represents that its use of the Services will comply with all applicable data protection, privacy, and industry-specific regulations applicable to Customer’s business.

28.3 If compliance with any law requires modification of this Agreement, the Parties shall negotiate in good faith to effect such modification. If no modification can be agreed upon, the affected Party may terminate upon thirty (30) days’ notice.

ARTICLE 29 — NO THIRD-PARTY BENEFICIARIES

29.1 This Agreement is for the sole benefit of the Parties and their permitted successors and assigns. Nothing in this Agreement, express or implied, confers any rights or remedies upon any third party, including Customer’s employees, clients, or other users of Customer’s systems.

29.2 Customer’s end-users (employees, contractors) have no direct contractual relationship with Provider and cannot make claims against Provider under this Agreement.

ARTICLE 30 — COUNTERPARTS AND FORMAT

30.1 This Agreement may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument.

30.2 This Agreement may be delivered electronically (PDF, email, or web form) and shall have the same force and effect as a paper original.

IN WITNESS WHEREOF, the Parties have executed this Agreement as of the Effective Date.

PROVIDER: Heaven Technology LLC

By: ___________________________
Name:
Title:
Date: ___________________________

CUSTOMER:

By: ___________________________
Name:
Title:
Entity: ___________________________
Date: ___________________________

EXHIBIT A — SERVICE DESCRIPTION

The following services are included in the Exclusive Membership Plan at $999.00 per site per month:

1. 24/7 help desk & remote monitoring (all infrastructure)
2. 15-minute response time (24/7/365)
3. Proactive issue detection & resolution
4. Full cybersecurity stack (EDR, email security, MFA, firewall, vulnerability scanning, patching, security training)
5. Cloud management — Microsoft 365 & Azure administration
6. Backup & disaster recovery management (automated, verified, tested monthly)
7. Network monitoring & optimization
8. Unlimited same-day on-site visits (guaranteed, up to 4 hours per visit)
9. Dedicated IT Manager (named contact, primary point of contact)
10. Quarterly IT strategy sessions (60–90 min, executive-level, with written report)
11. Executive dashboards & monthly executive reporting
12. Preferred hardware/software pricing (minimum 5% off list on purchases >$500)
13. 99.9% uptime SLA with credits
14. Project management included (up to 2 concurrent projects)
15. Annual IT budget planning session & written plan
16. Priority phone support (direct to Dedicated IT Manager, no queue)

Out-of-scope work: $85/hour, 1-hour minimum, requires prior written authorization. Hardware/software at Preferred Pricing. Additional concurrent projects beyond 2: $250/project/month or $85/hour.

EXHIBIT B — SLA CREDIT SCHEDULE

Missed Metric	Credit (% of Monthly Fee)
First response > 15 minutes	20%
Remote resolution > 4 Business Hours	10%
Critical Incident not resolved within 4 hours	20%
On-Site Visit not performed same day	25%
Backup verification / test-restore not completed	5%
Critical patch not deployed within 14 days	5%
Quarterly Strategy Session not delivered within 5 Business Days	10%
Monthly Executive Report not delivered within 5 Business Days	5%
Uptime 99.0%–99.89%	15%
Uptime 98.0%–98.99%	30%
Uptime 97.0%–97.99%	45%
Uptime below 97.0%	50%
Maximum total per month	50%