Fig Platform MSP Subscription Agreement

These standard subscription terms apply to the organisation identified in your accepted order. Your order confirmation records the order reference, date and commercial details.

1.Agreement overview

This Subscription Agreement is between Fig Technology Limited and the customer named in the Order Form. In this agreement, Fig, we, us and Supplier mean Fig Technology Limited, and Customer, you and your mean the customer named in the Order Form.

The documents that make up the contract are:

1. a.the accepted Order Form;
2. b.this Subscription Agreement;
3. c.the MSP Partner Agreement;
4. d.the Data Processing Agreement;
5. e.the Product-Specific Terms;
6. f.the Service Level Agreement;
7. g.the Support Policy;
8. h.the Platform Terms of Use for individual authorised users; and
9. i.the Documentation.

The current public versions of the supplementary terms are available at the following addresses:

If the documents conflict, the order of priority is: (a) the Order Form, for commercial terms it expressly overrides; (b) the MSP Partner Agreement, where it applies; (c) this Subscription Agreement; (d) the Data Processing Agreement; (e) the Product-Specific Terms, Service Level Agreement and Support Policy; and (f) the Documentation.

2.Order Form

Each subscription is governed by an Order Form, completed and accepted electronically, which sets out the commercial terms of the subscription. The Order Form records the parties’ details, the subscription plan, the initial and renewal terms, the start date, the Fees and payment terms, any included users, integrations, assets or other usage limits, the support tier, the Fig Software components included, the MSP commercial model, the End-Customer onboarding process, whether Direct Integrations and Cross-Customer Integrations are permitted, and any special terms or agreed overrides.

The Order Form incorporates this Subscription Agreement and the supplementary terms listed above. Where the Order Form expressly overrides a commercial term, the Order Form prevails.

3.Definitions

In this agreement, except where a different interpretation is necessary in the context, the words and expressions set out below have the following meaning:

Capitalised terms not defined here have the meanings given in the Order Form, Product-Specific Terms, MSP Partner Agreement or Data Processing Agreement, depending on the context.

4.Your subscription and licence

During the subscription term, and subject to payment of the Fees and compliance with this agreement, Fig grants you a non-exclusive, non-transferable, revocable right to:

1. a.access and use the Fig Services;
2. b.install and run the Fig Software; and
3. c.use the Fig Services for your internal compliance, security, governance and risk-management purposes.

You may also use the Fig Services to provision and provide services to End Customers in accordance with clause 6A and the MSP Partner Agreement. All rights not expressly granted to you are reserved by Fig.

5.Fair use and restrictions

You must not, and must ensure your Authorised Users do not:

1. a.make the Fig Services available to anyone outside your organisation, except to your End Customers as permitted by clause 6A and the MSP Partner Agreement;
2. b.resell, sub-license or commercially exploit the Fig Services except as allowed by the MSP Partner Agreement;
3. c.modify, reverse engineer, decompile or create derivative works from the Fig Services;
4. d.probe, test or bypass Fig security controls without Fig’s written permission;
5. e.use the Fig Services to build or support a competing product;
6. f.give Fig Service access to a Fig competitor;
7. g.introduce malicious code;
8. h.remove Fig branding or proprietary notices;
9. i.use the Fig Services unlawfully; or
10. j.use the Fig Services in breach of this agreement or the supplementary terms.

Fig may suspend access immediately where we reasonably suspect a breach of this section or where continued access creates a security or legal risk. Where practical, we will notify you and limit the suspension to what is necessary.

6.Your responsibilities

You are responsible for:

1. a.approving, managing and removing Authorised Users;
2. b.ensuring Authorised Users comply with the Platform Terms of Use;
3. c.giving Fig the co-operation, access and decisions reasonably needed to provide the Fig Services;
4. d.securing your own endpoints, cloud environments, networks and credentials;
5. e.ensuring the accuracy of your instructions and data;
6. f.obtaining the authorisations needed for any scanning, monitoring, integrations or software deployment;
7. g.complying with applicable law, including data protection law; and
8. h.making your own compliance, governance and risk-management decisions.

The Fig Services are tools that support your compliance and security programme. They are not legal advice, an audit opinion or a formal certification, and they do not by themselves make you compliant with any law, standard or framework.

6A.MSP Partner terms

This clause 6A applies to the MSP’s provision of the Fig Services to its End Customers and forms part of this agreement.

6A.1 Right to serve End Customers

Fig grants the MSP a limited, non-exclusive and non-transferable right to:

1. a.provision approved End Customers onto the Fig Services;
2. b.install Fig Software within End-Customer environments;
3. c.operate approved Direct Integrations;
4. d.use Output to deliver managed services to End Customers; and
5. e.describe itself as a Fig partner or reseller in line with Fig’s brand guidelines.

The MSP must not white-label the Fig Services, remove Fig branding, provide access to a Fig competitor, or resell/sub-license the Fig Services beyond the scope agreed in the Order Form and MSP Partner Agreement.

6A.2 End-Customer onboarding

Before using Fig for an End Customer, the MSP must submit the End-Customer details required by Fig. Unless the Order Form says otherwise, this is done through the Trust Centre or in writing. Each End-Customer onboarding submission should include the End Customer legal name; company number, if applicable; registered address; primary technical contact; number of employees or size bracket; selected compliance frameworks; framework tier; infrastructure option; requested go-live date; agreed Direct Integration scope; confirmation that an End-Customer Agreement is in place; and the MSP’s contracted scope of services for that End Customer.

Fig may decline or delay onboarding where an End Customer is a Fig competitor, is subject to sanctions, lacks required authorisation, or creates a legal, regulatory or security risk.

6A.3 Required End-Customer Agreement

The MSP must have a written End-Customer Agreement in place before using the Fig Services for that End Customer. That End-Customer Agreement must, at minimum:

1. a.limit the End Customer’s use to its own internal purposes;
2. b.prohibit onward resale;
3. c.include restrictions equivalent to the restrictions in this agreement;
4. d.authorise Fig and the MSP to install software and perform agreed scanning, monitoring, reporting and integrations;
5. e.confirm the End Customer is Controller of its own personal data;
6. f.confirm the MSP and Fig act as Processor/Sub-processor where applicable;
7. g.permit Fig to use Sub-processors and international transfer mechanisms under the Data Processing Agreement;
8. h.record the agreed scope of any Direct Integration;
9. i.confirm the End Customer has no direct commercial contract with Fig, except for limited data-protection commitments and any third-party beneficiary rights stated in the MSP Partner Agreement;
10. j.require the End Customer to raise ordinary support and service issues with the MSP, not Fig;
11. k.include a liability cap and exclusion of indirect losses;
12. l.require the End Customer to indemnify the MSP for matters the MSP is required to indemnify Fig for, where caused by the End Customer;
13. m.clearly describe the MSP’s contracted services; and
14. n.where vulnerability scanning is used, include the written authorisations required by the Product-Specific Terms.

Fig should be named as a third-party beneficiary of those minimum terms, entitled to enforce them directly where needed. Fig may ask for a redacted copy of an End-Customer Agreement, with commercial terms removed, to confirm compliance.

6A.4 MSP responsibility for End Customers

The MSP is responsible to Fig for its End Customers’ acts and omissions as if they were the MSP’s own. This includes responsibility for End-Customer compliance with usage restrictions; ensuring scanning, monitoring and integrations are authorised; payment of Fees for End-Customer use; first-line support to End Customers; notices to Fig when an End Customer relationship ends; removal of Fig Software when an End Customer is de-provisioned; and ensuring Customer Data and End-Customer data is handled in line with the End-Customer Agreement and Data Processing Agreement.

Fig supports the MSP directly unless the Order Form or Support Policy says otherwise. Fig may contact an End Customer’s technical contact directly for personal data breaches, urgent security advisories, security incidents, responsible-disclosure issues or where law requires.

6A.5 No direct commercial relationship with End Customers

Unless Fig separately signs a direct agreement with an End Customer, Fig has no direct commercial relationship with that End Customer. Any service levels, warranties, support commitments, managed service commitments or indemnities the MSP gives to an End Customer are the MSP’s commitments, not Fig’s. The Service Level Agreement applies between Fig and the MSP. It does not give End Customers a direct service-credit claim against Fig unless Fig expressly agrees otherwise in writing.

6A.6 Direct Integrations and Cross-Customer Integrations

The MSP and End Customer are responsible for deciding whether a Direct Integration is appropriate and authorised. Cross-Customer Integrations are not permitted unless Fig separately approves them in writing. Fig may suspend or disable an integration where we reasonably believe continued operation creates a material security, legal or regulatory risk.

6A.7 Ending an End-Customer relationship

When an End Customer relationship ends, the MSP must notify Fig within 5 Business Days, stop providing the Fig Services to that End Customer, remove or arrange removal of Fig Software, and ensure the End Customer’s data is exported or deleted in line with the Data Processing Agreement and the End-Customer Agreement.

7.Fees, invoicing and payment

Fees are set out in the Order Form and are invoiced at the billing frequency and payment cadence stated in the Order Form. Unless the Order Form says otherwise:

1. a.Fees are invoiced annually in advance, and each invoice is payable within 30 days of the invoice date;
2. b.all Fees are exclusive of VAT and other applicable taxes;
3. c.usage above the agreed volume may be invoiced at the rates in the Order Form;
4. d.disputed invoices must be flagged in writing within 15 days of the invoice date;
5. e.the undisputed part of an invoice must still be paid on time;
6. f.late payment more than 15 days overdue may attract interest at 4 per cent per annum above the Bank of England base rate; and
7. g.late payment may lead to suspension of access.

Fig may increase Fees on each subscription anniversary by giving at least 60 days’ notice. The increase may be up to the greater of 5 per cent or the previous 12 months’ UK CPI increase. Any larger increase needs your consent.

8.Software updates and supported versions

Fig Software updates automatically by default. Fig may release improvements at its discretion and may deprecate features, provided we do not materially reduce the overall functionality ordered by you during the current subscription term or materially weaken the security measures in the Data Processing Agreement.

Fig supports the current release and the immediately preceding release of each Fig Software component. Unsupported versions may lose functionality, support and security updates. When the agreement ends, or when a component is removed from an endpoint or cloud environment, you must uninstall the relevant Fig Software within 30 days.

9.Service levels and support

Fig provides the Fig Platform in accordance with the Service Level Agreement, and support in accordance with the Support Policy. Service Credits under the Service Level Agreement are your sole remedy for a failure to meet the uptime commitment, except that this does not limit your right to terminate for material breach where the Service Level Agreement says that right applies.

10.Ownership, Customer Data and System Data

As between the parties, the relevant End Customer (or, where applicable, the MSP) owns the Customer Data and all intellectual property rights in it. Fig and its licensors own the Fig Services, Fig Software, Documentation, Output and System Data, and nothing in this agreement transfers ownership of Fig’s technology to the MSP or any End Customer.

The MSP grants, and shall procure that each End Customer grants, Fig (and its Sub-processors, to the extent necessary) the licence needed to host, process and use the Customer Data to provide the Fig Services, resolve technical issues, comply with law, and generate System Data.

Fig may use System Data in aggregated or de-identified form to operate, secure and improve the Fig Services and to develop new products. Fig will not publish System Data in a way that identifies the MSP, any Authorised User, any End Customer or any individual. If the MSP, an Authorised User or an End Customer provides feedback, ideas or suggestions about the Fig Services, Fig may use them freely without compensation or attribution.

11.Confidentiality and non-disclosure

In this agreement, “confidential information” means all non-public information disclosed by or on behalf of one party to the other in connection with this agreement, in whatever form, that is identified as confidential or that a reasonable person would consider confidential given its nature and the circumstances of disclosure. Fig’s confidential information includes, without limitation, all non-public information relating to the Fig Services, including pricing, fees, discounts and the commercial terms of the Order Form; product features, functionality, performance and results of testing; roadmaps and release plans; services, service descriptions and delivery methods; the Documentation, security information and Trust Centre materials; and the terms of this agreement. The MSP’s confidential information includes Customer Data and its non-public business, commercial and technical information.

Each party must keep the other party’s confidential information secret, must not disclose it to any third party except as permitted by this clause, use it only to perform and exercise its rights under this agreement, and protect it with at least the same care it applies to its own confidential information of similar importance.

Confidential information may be shared with professional advisers, contractors and End Customers, provided equivalent confidentiality obligations apply. Confidential information may also be disclosed where required by law or a regulator. The confidentiality obligations do not apply to information that is public, already known, independently developed, or lawfully received from a third party. These obligations survive termination for 5 years, and indefinitely for trade secrets.

12.Data protection

Each party will comply with the Data Processing Agreement for personal data processed in connection with the Fig Services. The Data Processing Agreement sets out the parties’ Controller, Processor and Sub-processor roles; the processing details; Fig’s processor obligations; breach notification commitments; security measures; Sub-processor rules; international transfer mechanisms; data retention; audit rights; and liability treatment.

The live Sub-processor List is maintained at https://www.figgroup.co.uk/subprocessors. The Trust Centre at https://docs.figgroup.co.uk contains current security, audit and assurance evidence, subject to access controls.

13.Warranties and disclaimers

Each party warrants that it is duly incorporated or validly existing, has authority to enter into this agreement, and will comply with applicable law when performing this agreement.

Fig warrants that the Fig Services will be provided materially in accordance with the Documentation; the Fig Services will not knowingly contain harmful code; and Fig will maintain the security measures described in the Data Processing Agreement.

If Fig breaches the Documentation warranty and you notify Fig within 30 days of becoming aware, Fig will re-perform the affected service. If re-performance is not reasonably possible, Fig may terminate the affected element and refund unused prepaid Fees for that element. This is your sole remedy for that warranty breach.

Except for the express warranties above, the Fig Services are provided “as is” and “as available”. Fig does not warrant that the Fig Services will be uninterrupted or error-free, that they will detect every security issue, or that using them will achieve or maintain compliance with any law, standard or certification. Implied warranties are excluded to the fullest extent permitted by law.

14.Term and renewal

This agreement starts on the start date in the Order Form and continues for the Initial Subscription Term stated in the Order Form. The Initial Subscription Term may be of any length agreed in the Order Form, including a period of three months or less.

Renewal operates as stated in the Order Form. Unless the Order Form says otherwise, at the end of the Initial Subscription Term the agreement renews automatically for successive renewal periods, each equal in length to the Initial Subscription Term, unless either party gives written notice of non-renewal before the end of the then-current term by the notice period stated in the Order Form (or, if none is stated, at least 60 days). The Order Form may instead specify a different renewal period, or that the agreement does not renew automatically and simply ends at the close of the Initial Subscription Term.

If the Order Form specifies a minimum committed term and the Customer terminates before the end of that committed term other than for Fig’s material breach or by validly exercising a break right under clause 15, the Fees for the remainder of the committed term become immediately due. The parties agree this is a genuine pre-estimate of Fig’s loss and not a penalty. Where the Order Form specifies no minimum committed term, no such early-termination charge applies.

15.Termination

15.1 Termination for convenience (break)

Either party may terminate this agreement for convenience by giving the other written notice. Unless the Order Form states a different notice period, the notice period is at least 60 days; except that, where notice of termination is given within the first three months of the subscription (measured from the start date), the notice period is at least 30 days. Unless the Order Form provides otherwise, this break right may be exercised at any time during the subscription. Where the Order Form specifies a minimum committed term or one or more break dates, those terms apply. Termination under this clause does not trigger the early-termination charge in clause 14, provided it is exercised in accordance with this clause and the Order Form.

15.2 Termination for breach or insolvency

Either party may terminate immediately if the other party commits a material breach that cannot be remedied; commits a material breach that can be remedied but is not remedied within 30 days of written notice; or becomes insolvent. Non-payment of undisputed Fees more than 30 days overdue is a material breach.

15.3 Change of control

Fig may terminate on 30 days’ notice if you undergo a change of control to a direct competitor of Fig.

16.What happens when the agreement ends

On termination, your right to use the Fig Services ends; you must stop using the Fig Services; you must remove the Fig Software within 30 days; accrued but unpaid Fees remain payable; and provisions that are intended to survive continue to apply, including confidentiality, data protection, ownership, liability and dispute resolution.

You may request an export of Customer Data within 30 days of termination. Fig will provide the export in a common machine-readable format within a further 30 days, subject to payment of outstanding Fees. After that export window, Fig will delete Customer Data in line with the retention periods in the Data Processing Agreement.

17.Fig IP indemnity

Fig will defend you against a third-party claim that your authorised use of the Fig Services infringes that party’s UK, US or EU intellectual property rights. Fig will pay damages and costs finally awarded by a court or agreed in settlement.

If the Fig Services become subject to an IP claim, Fig may procure a licence; modify the affected service so it is non-infringing; or terminate the affected element and provide a pro-rata refund for unused prepaid Fees.

This indemnity does not apply where the claim arises from unauthorised modification; combination with third-party products; use outside the Documentation; or your own data or instructions.

18.Customer indemnity

You will indemnify Fig for losses arising from your breach of the restrictions in section 5; your compliance obligations; unauthorised scanning, monitoring or use of the Fig Services; or, where applicable, your obligations under the MSP Partner Agreement or section 6A, including End-Customer claims, missing or non-compliant End-Customer Agreements, Direct Integrations and Cross-Customer Integrations.

Each indemnity depends on prompt notice, the indemnifying party having control of the defence, and reasonable co-operation. Each indemnity is the sole remedy for the matters it covers.

19.Limitation of liability

Nothing in this agreement limits liability for death or personal injury caused by negligence; fraud; breach of statutory implied terms as to title; or any liability that cannot lawfully be limited.

Subject to that, neither party is liable for loss of profits; loss of revenue; loss of business; loss of goodwill; or indirect or consequential loss.

Each party’s total liability in any 12-month period is capped at 125 per cent of the Fees paid or payable in that period (the General Cap). Liability for breach of confidentiality, data protection obligations, or Fig’s security obligations is capped at 2 times the General Cap. The Customer acknowledges that these limits are reasonable and reflected in the pricing of the Fig Services.

20.General terms

20.1 Force majeure

Neither party is liable for delays caused by events beyond its reasonable control, provided it notifies the other promptly. Either party may terminate if the event continues for more than 60 days.

20.2 Assignment and subcontracting

You may not assign or subcontract this agreement without Fig’s consent. Fig may assign this agreement to a group company or to a successor on a merger or sale of its business. Fig may subcontract to approved Sub-processors while remaining responsible for their acts.

20.3 Changes, waiver and severance

Changes must be agreed in writing. A failure to enforce a right is not a waiver of that right. If a provision is found unenforceable, it will be modified to the minimum extent necessary and the rest of the agreement will continue.

20.4 No partnership

Nothing in this agreement creates a partnership, joint venture or agency between the parties.

20.5 Third-party rights

Except as expressly set out in the MSP Partner Agreement for End Customers, no third party may enforce any term of this agreement.

20.6 Entire agreement

This agreement, the Order Form and the incorporated documents listed above form the entire agreement between the parties for the Fig Services.

20.7 Compliance

Each party will comply with applicable anti-bribery, modern slavery, export control and sanctions law in performing this agreement.

20.8 Publicity

Neither party will issue a press release naming the other without consent. Fig may list the Customer as a partner or user on its website and sales materials unless the Customer opts out in writing.

20.9 Insurance

Fig maintains commercial general liability and cyber/technology errors and omissions insurance appropriate to its business. Certificates are available on reasonable request.

21.Governing law and disputes

This agreement is governed by the law of England and Wales. The English courts have exclusive jurisdiction over disputes. Before starting court proceedings, other than for urgent injunctive relief, the parties will use reasonable efforts to escalate the dispute to senior commercial contacts for resolution within 15 Business Days.

22.Notices

Notices must be in writing and sent to the address in the Order Form or by email. Notices to Fig must copy legal@figgroup.co.uk. Notices are deemed received on delivery, if delivered by hand; at 9am on the second Business Day after posting; or on email transmission, provided no bounce-back is received. This notice clause does not apply to service of legal proceedings.

Electronic acceptance

You accept these terms on behalf of the organisation identified in your order by completing the electronic acceptance presented during checkout or by signing an Order Form that incorporates them. You confirm that you are authorised to enter into this agreement for that organisation. No handwritten signature is required for an order accepted through checkout. The accepted order and its recorded commercial details form the Order Form for that subscription.