MASTER SERVICE AGREEMENT This Master Service Agreement (the "Agreement") is entered into as of [DATE], by and between: Information Security Kentucky, LLC David Martin, Owner Radcliff, Kentucky (Hardin County) Phone: (270) 250-3457 Email: customerservice@informationsecuritykentucky.com (the "Service Provider") — and — [CLIENT FULL LEGAL NAME] [CLIENT ADDRESS] (the "Client") Purpose. The purpose of this Agreement is to describe clearly how we will work together and what each of us is responsible for, so there are no surprises. My goal is to provide straightforward security and recovery services with clear expectations on both sides. 1. Services Service Provider provides information security and recovery services, including backup implementation and verification, recovery planning, account and email security, multi-factor authentication setup, breach response assistance, and related consulting. The specific services provided to Client are described in the applicable Statement of Work. Service Provider does not provide general information technology support (including printer, Wi-Fi, hardware repair, or help desk services). 2. Statements of Work The services, service tier, fees, deliverables, response expectations, and any included software licensing for Client are defined in one or more Statements of Work signed by both parties. Each Statement of Work is governed by this Agreement. If a Statement of Work conflicts with this Agreement, the Statement of Work controls for that engagement. 3. Payment terms Fees are stated in the applicable Statement of Work. Invoices are due within fifteen (15) days of the invoice date. Amounts not paid by the due date accrue interest at one and one-half percent (1.5%) per month, or the maximum permitted by Kentucky law if lower. 4. Backup and recovery — responsibilities and limitations Where Client's Statement of Work includes backup monitoring or verification, Service Provider performs those checks as described in the Statement of Work and reports the results to Client. Client remains responsible for: maintaining working hardware and internet connectivity; keeping backup devices connected and powered as directed; maintaining access to Client's own cloud storage accounts; not disabling, uninstalling, or modifying backup software installed under this Agreement; and promptly notifying Service Provider of hardware changes, office moves, or suspected security incidents. Client acknowledges and agrees that: - No backup system guarantees 100% recovery of data under all circumstances. - Service Provider is not responsible for data loss arising from hardware failure, ransomware, user error, third-party service outages, environmental events, or other circumstances outside Service Provider's reasonable control. - Service Provider strongly recommends following the 3-2-1 backup rule (three copies, two media types, one off-site), and Client's Statement of Work will describe which parts of that rule the engaged services cover. 5. Client responsibilities In addition to the responsibilities in Section 4, Client agrees to: provide reasonable access to systems and accounts as needed to perform the services; designate a point of contact authorized to make decisions; follow, or expressly decline in writing, security recommendations Service Provider provides; and promptly report suspected incidents rather than attempting remediation that may destroy evidence or worsen the situation. 6. Support and response expectations Service Provider is a single-operator business. Routine support requests are handled during normal business hours. Specific response targets, if any, are stated in the Statement of Work. Emergency response is provided on a best-effort basis and is billed as described in the Statement of Work. Nothing in this Agreement creates an obligation of continuous, after-hours, or guaranteed-availability support unless expressly stated in a Statement of Work. 7. Software licensing Where a Statement of Work includes licensing for software owned by Service Provider (including VaultGuard Backup), the license remains active while Client's retainer is active and terminates thirty (30) days after termination of this Agreement, unless Client purchases a separate subscription. All software, documentation, and related intellectual property remain the property of Service Provider. Because backups created under this Agreement use the Windows system image format, termination of a software license does not prevent Client from restoring existing backups using Windows' built-in recovery tools. 8. Limitation of liability Service Provider's total aggregate liability arising out of or relating to this Agreement, whether in contract, tort, or otherwise, shall not exceed the total fees paid by Client to Service Provider in the twelve (12) months preceding the event giving rise to the claim. In no event shall Service Provider be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, including damages for lost profits, lost revenue, lost data, or business interruption, even if Service Provider has been advised of the possibility of such damages. 9. Termination and data handling Either party may terminate this Agreement with thirty (30) days written notice to the other party. Notice may be delivered by email to the addresses listed in this Agreement. Upon termination and at Client's written request, Service Provider will delete or destroy Client data in Service Provider's possession or control (including any off-site backup copies managed by Service Provider under a Statement of Work) and will issue a Certificate of Data Destruction within thirty (30) days identifying what was destroyed and the method used. This certificate covers only data and media in Service Provider's possession or control. Drives, media, and data retained by Client remain Client's responsibility, and backups stored in Client's own accounts or on Client's own equipment are not affected by termination. 10. Confidentiality Each party agrees to maintain the confidentiality of any non-public information disclosed by the other party in connection with this Agreement, and to use such information solely for the purposes of performing under this Agreement. 11. Independent contractor Service Provider is an independent contractor, not an employee or agent of Client. Nothing in this Agreement creates a partnership, joint venture, or employment relationship between the parties. 12. Governing law and venue This Agreement is governed by the laws of the Commonwealth of Kentucky, without regard to its conflict of laws principles. Any dispute arising out of or relating to this Agreement shall be brought exclusively in the state courts located in Hardin County, Kentucky, or the federal courts having jurisdiction over Hardin County, Kentucky. 13. Entire agreement This Agreement, together with any Statements of Work referencing it, constitutes the entire agreement between the parties regarding the subject matter and supersedes any prior agreements. This Agreement may be modified only in writing signed by both parties. Signatures Client: Signature: _______________________________ Printed name: _______________________________ Title: _______________________________ Date: _______________________________ Service Provider: Signature: _______________________________ David Martin, Owner Information Security Kentucky, LLC Date: _______________________________