Fig MSP Partner Agreement.

This MSP Partner Agreement applies where the Customer is a managed service provider, reseller or similar intermediary ("MSP") procuring the Fig Services to provide managed compliance, security or risk-management services to its own end-user customers ("End Customers"). It's incorporated into, and forms part of, the Master Subscription Agreement. Where this Agreement conflicts with the body of the Master Subscription Agreement, this Agreement prevails, except on interpretation, confidentiality, indemnities, liability and governing law, where the Master Subscription Agreement prevails.

1. Right to provide the Fig Services to End Customers

Fig grants the MSP a limited, non-exclusive, non-transferable right to provision End Customers onto the Fig Services, install the Fig Software within their environments, operate a Direct Integration with each End-Customer environment, and use Output to deliver managed services - provided the MSP doesn't sub-license, white-label or resell the Fig Services beyond this, doesn't provide access to a Fig competitor, and doesn't remove Fig's branding.

2. Onboarding and de-provisioning End Customers

Each End Customer is added by the MSP submitting a completed End-Customer Order Form (see the template at the end of this document) via Fig's Trust Centre or in writing, providing the End Customer's details, size and framework selection, technical contact, and confirmation that an End-Customer Agreement (below) is in place. Fig provisions the environment and any Direct Integration in line with the Service Level Agreement, and may decline to onboard an End Customer that's a Fig competitor, subject to sanctions, or otherwise poses a legal or security risk. Fig currently provisions End-Customer environments centrally; it may, on 30 days' notice, delegate some or all of this to the MSP. When an End Customer relationship ends, the MSP must notify Fig within 5 Business Days, stop providing the Fig Services to that End Customer, and ensure the Fig Software is removed and the End Customer's data is handled in line with the End-Customer Agreement.

Fig may update its standard pricing, partner pricing, discount structures and packaging for new End Customers from time to time. Unless otherwise stated in the applicable Order Form, updated prices apply only to End Customers onboarded after the effective date of the pricing change, and don't change Fees already agreed for existing End Customers during their then-current subscription term.

3. Required terms in the MSP's End-Customer Agreement

The MSP must have a written agreement with each End Customer, before providing the Fig Services to it, that at minimum:

• limits the End Customer's use to its own internal purposes, with no onward resale;
• includes restrictions on the Fig Services equivalent to those in the Master Subscription Agreement;
• records the End Customer's authorisation for Fig to install software and perform scanning, monitoring and reporting on its systems;
• confirms the End Customer is the Controller of its own personal data, that the MSP and Fig act as Processor/Sub-processor as applicable, and that Fig may sub-process and transfer personal data internationally on the terms of the Data Processing Agreement;
• records the End Customer's agreement to the scope of any Direct Integration between its environment and the MSP's;
• confirms the End Customer has no direct contractual relationship with Fig beyond the limited rights described in section 5 below, and will direct support and service issues to the MSP, not Fig;
• includes a liability cap and exclusion of indirect losses, and an obligation on the End Customer to indemnify the MSP for matters the MSP is required to indemnify Fig for, where caused by the End Customer;
• specifies clearly the scope of services the MSP is contracted to provide (since the MSP's authority to use the Fig Services for that End Customer is limited to that scope); and
• where the MSP uses the Vulnerability Scanner against the End Customer's assets, includes the End Customer's written authorisation as required by the Product-Specific Terms.

Fig should be named as a third-party beneficiary of these terms, entitled to enforce them directly. Fig may ask, on reasonable request, for a redacted copy of an End-Customer Agreement (commercial terms redacted) to confirm compliance.

4. Direct Integrations and Cross-Customer Integrations

Where the Fig Services support it, the MSP's environment may be directly integrated with an End Customer's environment ("Direct Integration"), or with another Fig customer's environment ("Cross-Customer Integration"). Fig provisions the technical connection centrally, but the scope, permissions, and appropriateness of any such integration - and all consents, contractual arrangements and access-control decisions needed to support it - are the joint responsibility of the MSP and the other party to the integration, not Fig. Fig may suspend or disable an integration where it reasonably believes continued operation poses a material security, legal or regulatory risk.

5. No privity between Fig and the End Customer

Fig has no contractual relationship with an End Customer and makes no commitment to an End Customer, except that: Fig owes each End Customer, as a third-party beneficiary, the Data Processing Agreement obligations that apply to that End Customer's personal data, and Fig may communicate directly with an End Customer's technical contact for data-breach notification, urgent security advisories, or where the law requires it. Beyond this, the End Customer has no right to enforce any term of the Master Subscription Agreement or this Agreement against Fig - including Service Levels, which Fig owes to the MSP only. Any commitment the MSP gives an End Customer (service levels, warranties, indemnities, and so on) is the MSP's own commitment, not Fig's.

6. MSP responsibility for End Customers

The MSP is responsible to Fig for its End Customers' acts and omissions as if they were its own - including paying the Fees for End-Customer use, ensuring End-Customer compliance with the restrictions in the Master Subscription Agreement, and having a valid End-Customer Agreement in place. The MSP indemnifies Fig for claims arising from an End Customer's breach, from a missing or non-compliant End-Customer Agreement, or from a Direct or Cross-Customer Integration, on the terms of the Master Subscription Agreement's indemnity clause. The MSP must not tell an End Customer that Fig is responsible for something that is, in fact, the MSP's responsibility.

7. Branding and marketing

The MSP may describe itself as a Fig partner or reseller, and use Fig's name and logo for that limited purpose in line with Fig's brand guidelines. The MSP may not white-label the Fig Services as its own unless it has a separate written white-labelling addendum with Fig.

8. Ending the MSP arrangement

Termination of the Master Subscription Agreement (or of the MSP's right to serve a particular End Customer) triggers the standard termination provisions of the Master Subscription Agreement in respect of all, or the relevant, End Customers. Fig may (but doesn't have to) offer affected End Customers a direct subscription on Fig's standard terms. The MSP remains solely responsible for the consequences of the termination as between itself and its End Customers.

End-Customer Order Form (template)

Each End Customer is onboarded using this template, submitted via the Trust Centre or in writing.

This document is part of Fig's public legal documentation. It works alongside our Terms of Service, Master Subscription Agreement, Product-Specific Terms, Data Processing Agreement, Service Level Agreement and Support Policy.