Mahmoodi Tech Solutions

Master Services Agreement — summary of terms

The commercial terms a client signs, in plain English: how the agreement is structured, what we commit to, what it costs, how it ends, and how you get your environment back.

How the agreement is structured

Two layers. The Master Services Agreement is signed once and carries everything that does not change from engagement to engagement: confidentiality, data protection, intellectual property, liability, insurance, termination and governing law. Individual statements of work sit under it and carry what does change: scope, deliverables, service levels, seat counts, rates, milestones and dates.

The effect is that a second or third engagement needs a two-page statement of work rather than a fresh negotiation. A managed IT engagement, a compliance readiness program and a software build can run in parallel under one master agreement, each with its own statement of work.

• Order of precedence. On a conflict, the statement of work controls for matters of scope, deliverables, service levels, term and price for that engagement. The Master Services Agreement controls for everything else, including liability, insurance, confidentiality and intellectual property.
• The Data Processing Addendum controls over both on the handling of personal data.
• Variations are effective only in writing and signed by both parties. A statement of work cannot silently amend the master agreement's liability, insurance or IP terms — an amendment to those has to say so, in terms, and be signed as such.
• Purchase-order and vendor-portal terms attached to an invoice or a procurement system do not apply. This is stated in the agreement so that nobody has to argue about it later.

Anything outside the scope described in a statement of work is out of scope until a written change order says otherwise. Typical exclusions — hardware, third-party licensing, projects above a stated size, and unsupported operating systems — are named in the statement of work rather than left to inference.

Service levels

Service levels attach to managed services engagements and are set in the statement of work for the tier you buy. Severity is determined by business impact, not by who reports it. Response means a human acknowledgement from an engineer who owns the ticket, not an automated receipt.

• Coverage hours. Standard coverage is [business-hours window, stated with time zone], with [after-hours arrangement] on the tiers that include it. Public holidays observed are listed in the statement of work.
• Escalation path. Named in the statement of work and in your onboarding runbook: the assigned engineer, then [service desk lead], then your [named account lead], then [executive sponsor]. Every level has a name, a mobile number and a stated time after which the ticket rises on its own without you having to chase it.
• Reporting. Attainment against target is reported [reporting frequency], including the misses, whether or not you ask for it.
• Sustained failure. Falling below [attainment threshold] across [measurement period] is a stated termination trigger for you, exercisable without penalty. Service credits, where the statement of work provides for them, are set out there.
• What pauses the clock. Time spent waiting on client approval, on a third-party vendor, or on access we have requested and not been granted is excluded from response measurement. Those exclusions are listed exhaustively in the statement of work rather than left open-ended.

Fees and invoicing

• Managed services are billed per user per month at the tier rate stated in the statement of work — [rate per user per month] — invoiced [billing cycle] in advance. A [seat minimum] applies to managed IT engagements.
• Seat-count true-ups. Seat count is measured on [measurement date] each month. Additions are billed [pro rata / from the following cycle] from the date of provisioning. Reductions take effect [reduction terms, e.g. from the following cycle, on written notice], so that a headcount change does not require a contract amendment.
• Projects and software are billed against milestones defined in the statement of work — typically [deposit percentage] on signature, the balance across [milestone schedule], with acceptance criteria stated per milestone. Time-and-materials work is billed [billing cycle] at [rate] against submitted timesheets.
• Onboarding is a one-time charge stated in the statement of work — [onboarding fee basis].
• Expenses are billed at cost, without markup, and only where pre-approved in writing. Travel beyond [travel radius] and third-party licensing purchased on your behalf are the usual cases.
• Third-party licences may be resold or procured in your name; which of the two applies is stated per product, because it determines who holds the contract if we part company.
• Payment terms are net [payment terms] from invoice date. Invoices are disputed in good faith within [dispute window]; undisputed portions remain payable while a dispute is worked through.
• Late payment. Interest accrues at [late payment rate] on overdue undisputed amounts. Suspension of service is possible only after [notice period] of written notice and only for undisputed amounts overdue by more than [suspension trigger]. Security monitoring and backup are not suspended, because switching those off over a billing dispute would put your business at risk to make a commercial point.
• Rate changes require [notice period] written notice and take effect no earlier than the renewal date, capped at [cap] in any twelve-month period.

Term, renewal and termination

• Initial term. [initial term] for managed services, running from the service commencement date rather than from signature. Project statements of work run to completion and acceptance.
• Renewal. After the initial term the agreement continues [renewal basis, e.g. month to month / for successive terms of X] unless either party gives [renewal notice period] written notice.
• Termination for convenience. Available to either party after the initial term on [convenience notice period] written notice. Fees are payable to the effective date; prepaid unused fees are refunded on a pro-rata basis.
• Termination for cause. Either party may terminate on material breach that is not cured within [cure period] of written notice describing the breach. Insolvency, and sustained service-level failure as described above, are immediate grounds for you.
• No exit fee. There is no termination penalty, no buyout of the remaining term on a for-cause exit, and no clause that makes your data or documentation conditional on anything other than payment of undisputed invoices.
• Survival. Confidentiality, data protection, intellectual property, liability, insurance, non-solicitation and governing law survive termination.

Transition out

The end of the relationship is the part of an IT contract that most deserves reading, and the part most often left vague. It is a defined deliverable here, not a favour.

• Assistance period. [transition period] of documented offboarding assistance from the termination effective date, at [standard rates / the rate stated in the statement of work], available whichever party terminated and for whatever reason.
• What is handed over. Current environment documentation and network diagrams; the asset, licence and vendor register; every credential and administrative account, transferred and then rotated; backup configurations and a verified restore point; runbooks, automations and scripts written for your environment; open tickets with their history; and your data in a documented, non-proprietary format.
• Agent and tooling removal. Our monitoring, management and security agents are removed from your estate on a scheduled date, confirmed in writing when complete.
• A working call. Direct engineer-to-engineer sessions with your incoming provider or internal team — [number] scheduled sessions — so the handover happens between the people who will actually operate the environment.
• Data deletion. Client data held in our systems is deleted or returned within [deletion window] of the end of the assistance period, with written confirmation, except where retention is required by law.

Intellectual property

• Work product assigns to you on payment in full for the engagement that produced it — including source code, infrastructure-as-code, configurations, prompt and agent definitions, and the documentation written about your environment.
• Pre-existing materials remain ours. Tools, frameworks, generic libraries and internal accelerators that existed before the engagement, or that we develop independently of it, stay our property. They are identified in the statement of work rather than described as a catch-all category.
• You get a licence to them — perpetual, irrevocable, worldwide, non-exclusive, royalty-free, transferable with the deliverable — for use, operation and modification of the deliverable they are embedded in. In practice that means nothing we leave behind can be switched off later, and nothing requires a continuing relationship with us to keep running.
• Your data is yours throughout, and is never used to train any model, ours or a vendor's.
• Open-source components used in a deliverable are listed with their licences at delivery.
• Feedback and residual knowledge. We remain free to use general skills and know-how retained in memory. That is not a licence to your confidential information, and the confidentiality obligations below are not qualified by it.

Confidentiality and data protection

• Mutual confidentiality covering information disclosed in any form, surviving [survival period] after termination, and indefinitely for trade secrets and personal data.
• A Data Processing Addendum forms part of any engagement that touches your systems or personal data. It names the processing purposes, the categories of data, the retention periods, the approved sub-processors and their locations, the security measures, and the assistance we provide on data-subject requests.
• Breach notification within [notification window] of becoming aware of a security incident affecting your data, with the facts as they are known at the time rather than after they have been tidied.
• Sub-processor changes are notified [sub-processor notice period] in advance, with a right to object.
• Sector obligations. Where your business is subject to HIPAA, GLBA, PCI DSS, FERPA or a state privacy statute, the applicable addendum — a Business Associate Agreement, for instance — is executed before any access is granted, not after go-live.

How and where the work is delivered

Engineering is delivered from the United States and from India. We put that in the agreement and on this page because a buyer who discovers it at diligence stage is right to be annoyed, and because most of the questions it raises have specific, documented answers.

• Contracting entity. You contract with the US entity, under Illinois law, and are invoiced by it. Commercial authority, escalation and incident command sit in Chicago.
• Who does what. Client-facing accountability, architecture, security incident command and on-site work are performed in the United States. Software development, data engineering, QA, automation build, overnight monitoring and scheduled maintenance are performed by the engineering team in Hyderabad. Each statement of work states which functions are delivered from where.
• Access controls. Offshore access to a client environment is through a hardened jump host with multi-factor authentication, from managed devices only, least-privilege, time-boxed to a named task, with session recording and privileged-action logging to a store the offshore team cannot alter. Standing administrative rights are not issued.
• Device standards. Company-managed endpoints with disk encryption, endpoint detection, enforced patching and remote wipe. Personal devices are not used for client work.
• Background checks and personnel obligations. Staff with access to client environments are background-checked to the extent local law permits, are under written confidentiality and data-handling obligations, and complete security training [training frequency].
• Data residency. Where your contracts or regulators require data residency or US-only handling, that restriction is documented in the statement of work and the DPA before any access is granted, and priced accordingly. We will not accept a restriction we cannot operationally honour.
• Named people. You receive the names and roles of the engineers assigned to your account, and they do not rotate silently. Changes to the named team are notified.

Security obligations

Security commitments are two-sided, and a provider who only writes down their own half is describing something they cannot deliver. Both halves appear in the agreement.

What we commit to

• Multi-factor authentication on all administrative access to your environment, without exception.
• Patching and vulnerability remediation to the cadence stated in the statement of work — [patch cadence] — with an exception process for changes you have asked us to hold.
• Logging and monitoring of privileged activity, retained for [log retention period] and available to you for your own tenant on request.
• Backup configuration and [restore test frequency] restore testing, with the results reported to you.
• A documented incident response process, with defined roles, and incident command retained in the United States.
• Named security contacts, and cooperation with your auditors and regulators within the scope of the engagement.

What you must maintain

• Multi-factor authentication enabled for all users, and no shared or generic accounts.
• Supported, licensed operating systems and applications. Equipment past end-of-support is expressly out of scope until remediated, and the agreement says so rather than leaving it to be argued after an incident.
• Timely decisions on risk remediation we raise — within [client decision window] — or written acceptance of the risk. Accepted risks are logged, and the corresponding commitments are suspended for the affected systems.
• No local administrative rights for standard users, and no unmanaged devices on the corporate network, without a documented exception.
• Prompt notification of joiners, movers and leavers, so that access provisioning and revocation can meet target.

Where a commitment above is contingent on something you maintain, the agreement says which one, so that neither side is relying on an obligation the other never accepted.

Liability and insurance

• Mutual cap. Each party's aggregate liability is capped at the fees paid or payable under the relevant statement of work in the [cap measurement period] preceding the claim. The cap applies equally to both parties.
• Excluded damages. Neither party is liable for indirect, incidental, special or consequential damages, or for lost profits, revenue or anticipated savings.
• Carve-outs from the cap. Breach of confidentiality, infringement of third-party intellectual property, gross negligence or wilful misconduct, death or personal injury, and your obligation to pay undisputed fees.
• Indemnities. We indemnify you against third-party IP infringement claims arising from our deliverables; you indemnify us against claims arising from data or materials you supply and from your use of a deliverable outside its documented purpose.
• Insurance. We maintain commercial general liability of [limit], professional liability (errors and omissions) of [limit], cyber liability of [limit], and workers' compensation as required by Illinois law. Certificates of insurance are provided on request, and you may be named as an additional insured where your procurement requires it. The bracketed limits above are placeholders. They are stated only from the certificates actually issued by our carrier — never from an estimate.
• Force majeure excuses performance, but not payment for services already delivered, and not the transition-out obligations.

Subcontracting

We may use subcontractors and affiliated entities, including our own Indian engineering entity, and we remain fully responsible for their performance and for their compliance with the confidentiality, data protection and security terms of the agreement. Subcontractors with access to your environment are subject to the same access controls and personnel obligations as our employees. Material changes to the subcontracting arrangements described in a statement of work are notified [subcontractor notice period] in advance, and you may object on reasonable grounds relating to security or regulatory obligations.

Non-solicitation of personnel

Neither party solicits or hires the other's personnel who have been directly involved in the engagement, during the term and for [non-solicitation period] afterwards. General advertising and job postings not targeted at those individuals are excluded, and an employee who applies on their own initiative is not a breach. Where a hire is agreed by both parties, a placement fee of [fee basis] applies. The clause is mutual, and it is deliberately narrow — it protects continuity of the team on your account, and it is not a device to hold anyone's career hostage.

Governing law and dispute resolution

• Governing law. The laws of the State of Illinois, without regard to its conflict-of-laws rules. The UN Convention on Contracts for the International Sale of Goods does not apply.
• Venue. The state and federal courts located in [Cook County / county to be confirmed], Illinois, to whose exclusive jurisdiction both parties submit, subject to the dispute process below.
• Escalation first. A dispute is escalated to a named executive on each side, who meet within [escalation window] to attempt resolution before any formal step is taken.
• Then mediation. If escalation fails, non-binding mediation in Chicago under [mediation rules and provider], with costs shared equally.
• Then [litigation or binding arbitration] — the agreement specifies one, under [rules and seat, if arbitration]. Either party may seek injunctive relief for a breach of confidentiality or intellectual property rights at any time without completing the steps above.
• Notices are given in writing to the addresses stated in the agreement, and email notice is effective where the agreement says so.

What to do with this page

Read it before the first call, and bring the objections. If a term here does not work for your procurement, your insurer or your regulator, it is far cheaper to say so now than in month seven — and most of what is bracketed above is bracketed precisely because it is set per engagement rather than imposed.

To request the full Master Services Agreement, the Data Processing Addendum and our certificates of insurance, write to hello@mahmooditechsolutions.com or call the Chicago office. There is no form and no sequence attached to the request.