This Master Subscription Agreement ("Agreement") is entered into between Fig Technology Limited, a company incorporated in England and Wales (company number 16869280), whose registered office is at 11 Wandle Bank, Wimbledon, SW19 1DW ("Fig", "Supplier"), a wholly-owned subsidiary of The Fig Group Limited, and the customer identified in the applicable Order Form ("Customer").
This Agreement is incorporated by reference into every Order Form signed by Fig and the Customer. Where the Customer is a managed service provider procuring the Fig Services for resale or use in providing managed services to End Customers, the MSP Partner Agreement also applies and forms part of this Agreement. Together with the Product-Specific Terms, the Data Processing Agreement, the Service Level Agreement and the Support Policy (each incorporated by reference), these documents form the entire agreement between the parties in relation to the Fig Services.
1. Definitions
Capitalised terms not defined in the body of this Agreement have the meanings given in the Order Form, the Product-Specific Terms, the MSP Partner Agreement or the Data Processing Agreement, as context requires. The core definitions used throughout are:
- "Fig Services" - the Fig Platform together with the Fig Software (the Fig Endpoint Agent, Fig Cloud Agent, Fig Data Scanner and Fig Vulnerability Scanner), as described in the Product-Specific Terms.
- "Customer Data" - data submitted to, or ingested by, the Fig Services on the Customer's behalf, excluding System Data and Output.
- "System Data" - telemetry, usage, threat-intelligence and similar data generated through operation of the Fig Services, in aggregated or de-identified form.
- "Output" - reports, dashboards, scores and other materials the Fig Services generate for the Customer.
- "Documentation" - Fig's published technical and user documentation, made available within the Fig Platform or at www.docs.figgroup.co.uk.
- "Authorised User" - an individual authorised by the Customer to access the Fig Services, subject to the Platform Terms of Use.
- "Order Form" - the ordering document signed by both parties that sets out the commercial terms of a subscription and incorporates this Agreement.
If there's a conflict between documents, the order of precedence is: (1) the Order Form, for commercial terms it expressly overrides; (2) the MSP Partner Agreement, where applicable; (3) this Agreement; (4) the Data Processing Agreement; (5) the Product-Specific Terms, the Service Level Agreement and the Support Policy; (6) the Documentation.
2. Subscription and licence
Subject to payment of the Fees and compliance with this Agreement, Fig grants the Customer a non-exclusive, non-transferable, revocable right during the subscription term to access and use the Fig Services, and to install and run the Fig Software, for the Customer's own internal compliance, security, governance and risk-management purposes (and, where the Customer is an MSP, to provide services to End Customers in accordance with the MSP Partner Agreement). All rights not expressly granted are reserved by Fig.
3. Restrictions
The Customer must not, and must ensure its Authorised Users don't: make the Fig Services available to anyone outside the Customer's own organisation (except as permitted under the MSP Partner Agreement); resell, sub-license or commercially exploit the Fig Services; modify, reverse engineer or create derivative works of the Fig Services; attempt to probe or bypass security controls without Fig's written authorisation; use the Fig Services to build a competing product, or give access to a competitor of Fig; introduce malicious code; remove Fig's branding; or otherwise use the Fig Services unlawfully or in breach of this Agreement. Fig may suspend access immediately where it reasonably suspects a breach of this section or where continued use poses a security or legal risk, using reasonable endeavours to notify the Customer and limit the suspension to what's strictly necessary.
4. Customer obligations
The Customer is responsible for: authorising and managing its Authorised Users and ensuring they comply with this Agreement and the Platform Terms of Use; giving Fig the co-operation, access and decisions reasonably needed to provide the Fig Services; the security of its own endpoints, cloud environments and networks; the accuracy of instructions and data it provides; and complying with all applicable law, including data protection law, in its use of the Fig Services. The Customer acknowledges the Fig Services are tools that support a compliance programme - they don't themselves constitute legal advice, an audit, or a certification, and the Customer remains responsible for its own compliance decisions.
5. Fees, invoicing and payment
Fees are set out in the Order Form and are payable in accordance with its payment terms (standard payment terms are 30 days from invoice date). Where actual usage exceeds the volume set out in the Order Form, Fig may invoice additional fees calculated at the rates specified there. Late payment (more than 15 days overdue) may attract interest at 4% per annum above the Bank of England base rate and may result in suspension of access. Disputed invoices must be flagged in writing within 15 days of the invoice date, with the undisputed portion paid on time. All Fees are exclusive of VAT and other applicable taxes. Fig may increase Fees on each subscription anniversary, on at least 60 days' notice, by up to the greater of 5% or the prior 12 months' UK CPI increase; any larger increase needs the Customer's consent.
6. Fig Software updates
The Fig Software updates automatically by default. Fig may release enhancements at its discretion and may deprecate features, provided it doesn't materially reduce the overall functionality the Customer has ordered during the then-current subscription term, or materially weaken the security measures in the Data Processing Agreement. Fig supports the current release and the immediately preceding release of each Fig Software component; unsupported versions may lose functionality, support and security updates. On termination, or removal of a component from a particular endpoint or cloud environment, the Customer must uninstall it within 30 days.
7. Service Levels and support
Fig provides the Fig Platform in accordance with the Service Level Agreement, and support in accordance with the Support Policy, both incorporated by reference. Service Credits under the Service Level Agreement are the Customer's sole and exclusive remedy for a failure to meet the uptime commitment, without prejudice to the right to terminate for material breach under section 12.
8. Ownership, Customer Data and System Data
As between the parties, the Customer owns all rights in Customer Data. Fig (and its licensors) own all rights in the Fig Services, the Fig Software, the Documentation, the Output and System Data. The Customer grants Fig a licence to host, process and use Customer Data solely to provide the Fig Services, resolve technical issues, comply with law, and generate System Data. Fig may use System Data (in aggregated, de-identified form only) to operate, secure and improve the Fig Services and to develop new products, and will not publish System Data in a form that identifies the Customer or any individual. Feedback the Customer provides about the Fig Services may be used freely by Fig without compensation or attribution.
9. Confidentiality
Each party must keep the other's confidential information secret, use it only to perform this Agreement, and protect it with at least the same care it applies to its own confidential information of similar importance. Confidential information can be shared with professional advisers, contractors and (for the Customer, where it is an MSP) End Customers under equivalent confidentiality obligations, or where required by law or a regulator. These obligations don't apply to information that's public, already known, independently developed, or lawfully received from a third party, and they survive termination of this Agreement for 5 years (indefinitely for trade secrets).
10. Data protection
Each party will comply with its obligations under the Data Processing Agreement in respect of any personal data processed in connection with this Agreement. The parties' respective roles (Controller, Processor, Sub-processor) are set out there.
11. Warranties and disclaimers
Each party warrants it's duly incorporated, has authority to enter this Agreement, and will comply with applicable law in performing it. Fig warrants it will provide the Fig Services materially in accordance with the Documentation, that the Fig Services won't knowingly contain harmful code, and that it will maintain the security measures described in the Data Processing Agreement. If Fig breaches the Documentation warranty and the Customer notifies Fig within 30 days of becoming aware, Fig will re-perform the affected service or, if that's not reasonably possible, terminate the affected element and refund unused prepaid fees - this is the Customer's sole remedy for that breach.
Beyond these express warranties, the Fig Services are provided "as is" and "as available." Fig doesn't warrant the Fig Services will be uninterrupted or error-free, that they'll detect every security issue, or that using them will itself achieve or maintain compliance with any law, standard or certification. All warranties implied by law are excluded to the fullest extent permitted.
12. Term and termination
The Agreement runs for the Initial Subscription Term set out in the Order Form and then renews for successive 12-month periods unless either party gives written notice of non-renewal. A notice given during the first 3 calendar months of the Initial Subscription Term must give at least 30 days' notice. A notice given after the first 3 calendar months, or during any renewal term, must give at least 60 days' notice. A notice of non-renewal takes effect only at the end of the then-current subscription term and does not, by itself, bring that term to an early end.
An Order Form may expressly provide a different cancellation or early-exit right, including as part of a promotional initial free period. Any such right applies only where it is expressly stated in the Order Form and prevails over this section to the extent of any conflict.
Either party may terminate immediately for the other's material, unremedied breach (with a 30-day cure period for remediable breaches), or on the other's insolvency. Non-payment of undisputed Fees more than 30 days overdue is treated as a material breach. Fig may also terminate on 30 days' notice if the Customer undergoes a change of control to a direct competitor of Fig.
13. Effects of termination
On termination, all rights to use the Fig Services end and the Customer must stop using them and remove the Fig Software within 30 days. The Customer may request an export of its Customer Data within 30 days of termination; Fig will provide it in a common machine-readable format within a further 30 days, subject to payment of outstanding Fees, after which Fig will delete Customer Data in line with the retention periods in the Data Processing Agreement. Accrued but unpaid Fees remain payable. Provisions that by their nature should survive (including confidentiality, data protection, ownership, liability, and dispute resolution) continue to apply.
14. Indemnities
Fig's IP indemnity. Fig will defend the Customer against a third-party claim that the Customer's authorised use of the Fig Services infringes that party's UK, US or EU intellectual property rights, and will pay damages and costs finally awarded or agreed in settlement. If the Fig Services become subject to such a claim, Fig may (at its option) procure a licence, modify the service to be non-infringing, or terminate the affected element with a pro-rata refund. This indemnity doesn't apply where the claim arises from unauthorised modification, combination with third-party products, use outside the Documentation, or the Customer's own data or instructions.
Customer indemnity. The Customer will indemnify Fig against losses arising from the Customer's breach of the restrictions in section 3, its compliance obligations, or (where applicable) its obligations under the MSP Partner Agreement - including claims arising from unauthorised scanning or from an End Customer.
Both indemnities are conditional on prompt notice, the indemnifying party having control of the defence, and reasonable co-operation, and are each party's sole remedy for the matters they cover.
15. Limitation of liability
Nothing in this Agreement limits liability for death or personal injury caused by negligence, fraud, breach of statutory implied terms as to title, or any other liability that can't lawfully be limited. Subject to that, neither party is liable for loss of profits, revenue, business, goodwill, or any indirect or consequential loss. Each party's total liability in any 12-month period is capped at 125% of the Fees paid or payable in that period (the "General Cap"), except that liability for breach of confidentiality, data protection, or Fig's security obligations is capped at 2x the General Cap. The Customer acknowledges these limits are reasonable and reflected in the pricing of the Fig Services.
16. General provisions
Force majeure. Neither party is liable for delays caused by events beyond its reasonable control, provided it notifies the other promptly; either party may terminate if such an event continues for more than 60 days.
Assignment. The Customer may not assign or sub-contract this Agreement without Fig's consent. Fig may assign this Agreement to a group company or a successor on a merger or sale of its business, and may sub-contract to its approved sub-processors while remaining responsible for their acts.
Variation, waiver, severance. Changes must be agreed in writing. A failure to enforce a right isn't a waiver of it. If any provision is found unenforceable, it will be modified to the minimum extent necessary and the rest of the Agreement continues.
No partnership. Nothing in this Agreement creates a partnership, joint venture or agency between the parties.
Third-party rights. Save as expressly set out in the MSP Partner Agreement (in respect of End Customers), no third party may enforce any term of this Agreement.
Entire agreement. This Agreement, the Order Form, and the incorporated documents listed above constitute the entire agreement between the parties on this subject matter.
Compliance. Each party will comply with applicable anti-bribery, modern slavery, export control and sanctions law in performing this Agreement.
Publicity. Neither party will issue a press release naming the other without consent, though Fig may list the Customer as a partner or user on its website and sales materials unless the Customer opts out in writing.
Insurance. Fig maintains commercial general liability and cyber/technology errors & omissions insurance appropriate to its business; certificates are available on reasonable request.
17. Governing law and jurisdiction
This Agreement is governed by the law of England and Wales, and the English courts have exclusive jurisdiction over any dispute. Before starting court proceedings (other than for urgent injunctive relief), the parties will use reasonable efforts to escalate the dispute to senior commercial contacts for resolution within 15 Business Days.
18. Notices
Notices must be in writing, sent to the address in the Order Form or by email (copying legal@figgroup.co.uk for notices to Fig), and are deemed received on delivery, at 9am on the second Business Day after posting, or on transmission for email (provided no bounce-back is received). This doesn't apply to service of legal proceedings.
This document is part of Fig's public legal documentation. It works alongside our Terms of Service, Product-Specific Terms, MSP Partner Agreement, Data Processing Agreement, Service Level Agreement and Support Policy.