Client Service Agreements

1. Scope of Services

eSmith IT Consulting Inc. ("Service Provider") agrees to provide managed information technology services to the signing organization ("Client") as defined by the Client's selected service plan tier (e.g., Basic, Professional, Unlimited Remote, or eSmith ProCare). The specific scope of services, including monitoring, patch management, helpdesk support, on-site visits, and cybersecurity protections, is determined by the elected plan as published on the Service Plan Pricing page.

Out-of-Scope Work: Services not explicitly included in the Client's active plan — including but not limited to physical office relocations, major network infrastructure overhauls, new cable runs, and large-scale hardware deployment projects — are considered out-of-scope and will be quoted separately or billed at the Service Provider's standard hourly rate for the Client's plan tier.

2. Fees and Payment

A. Billing Cycle: Managed service recurring fees are invoiced in advance on the 1st of each calendar month. The first invoice may be prorated based on the service commencement date.

B. Payment Terms: All invoices are due Net 15 from the invoice date. Payment is accepted via ACH bank transfer, credit card, or check. Clients are strongly encouraged to enroll in automatic payment (ACH or credit card auto-pay) to ensure uninterrupted service.

C. Late Payment: Invoices not paid within 10 days of the due date will incur a late fee of 1.5% per month (18% annualized) on the outstanding balance. Service Provider reserves the right to suspend non-essential services for accounts more than 30 days past due, with 7 days written notice prior to suspension.

D. Hardware Procurement: Invoices associated with hardware, software licensing, or third-party vendor procurement must be paid in full prior to ordering or shipping.

3. Term and Termination

A. Term: This Agreement operates on a month-to-month basis. No long-term contracts are required unless a separate supplementary agreement is mutually executed.

B. Termination: Either party may terminate this Agreement with 30 calendar days of written notice (email to [email protected] is acceptable). The 30-day notice period ensures adequate time for a clean offboarding process, including credential handover, removal of monitoring agents, and final documentation transfer.

C. Final Payment: Upon termination, the Client remains responsible for all fees accrued through the end of the final service month, including any outstanding invoices for out-of-scope work or hardware procurement.

4. Authorization and Access

The Client authorizes eSmith IT Consulting to securely access, monitor, manage, and deploy software and configuration changes across all contracted endpoints, servers, network infrastructure, and cloud tenants. The Client warrants that they hold the legal authority to grant such access across their organizational footprint and will provide all necessary credentials, administrative permissions, and physical access required to deliver the contracted services.

5. Limitation of Liability

A. Liability Cap: In no event shall eSmith IT Consulting Inc.'s total aggregate liability arising out of or related to this Agreement exceed the total amount paid by the Client to the Service Provider during the twelve (12) months immediately preceding the event giving rise to the claim.

B. Exclusion of Damages: In no event shall the Service Provider be liable for any indirect, incidental, special, consequential, or punitive damages, including without limitation loss of profits, revenue, data, use, goodwill, or other intangible losses, regardless of whether the Service Provider has been advised of the possibility of such damages. This includes, but is not limited to, damages resulting from:

• Hardware or software failure outside of the Service Provider's direct operational control;
• Security breaches, ransomware, or data loss originating from attack vectors outside of eSmith IT's exclusively managed security perimeter;
• Third-party vendor outages, including but not limited to Microsoft 365, Internet Service Provider (ISP), and cloud hosting platform failures;
• Client failure to follow documented security policies, including but not limited to disabling Multi-Factor Authentication (MFA) or sharing credentials.

6. Shared Responsibility Model (Cybersecurity)

eSmith IT Consulting provides industry-leading cybersecurity tools, monitoring, and incident response capabilities as part of the Client's selected service plan. However, cybersecurity is a shared responsibility between the Service Provider and the Client.

Service Provider Responsibilities: Deploying, monitoring, and maintaining endpoint detection and response (EDR) software, firewall policies, patch management, email security configurations, and phishing awareness training platforms.

Client Responsibilities: Adhering to all documented security policies, including but not limited to: enforcing Multi-Factor Authentication (MFA) for all users when mandated; not sharing or reusing passwords; reporting suspicious emails or activity promptly; and maintaining current, active cybersecurity awareness training completion for all staff.

Important Disclosure: No security service, product, or provider can guarantee 100% protection against all cyber threats. eSmith IT Consulting is not a replacement for the Client's own Cyber Liability Insurance policy. The Client is strongly advised to maintain adequate cyber insurance coverage independently.

7. Confidentiality

eSmith IT Consulting agrees to maintain the strict confidentiality of all intellectual property, credentials, architectural diagrams, proprietary business information, and any data accessed during the course of delivering services under this Agreement. This obligation survives the termination of this Agreement.

8. Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of North Carolina, without regard to its conflict of law provisions. Any disputes arising under or in connection with this Agreement shall be subject to the exclusive jurisdiction of the state and federal courts located in Mecklenburg County, North Carolina.

9. Entire Agreement

This Agreement, together with the Service Level Agreement (SLA), constitute the entire agreement between the Service Provider and the Client and supersede all prior and contemporaneous agreements, proposals, representations, or communications, whether written or oral, concerning its subject matter. No modification, amendment, or waiver of any provision of this Agreement shall be effective unless in writing and signed by both parties. The parties specifically agree that electronic signatures submitted via the Service Provider's official web portal, and the subsequent digital receipts generated therefrom, shall satisfy all requirements for "writing" and "signing" under the ESIGN Act and applicable state laws.

1. Incident Priority Levels and Initial Response Targets

All support requests submitted through the official ticketing system are categorized by severity. The following table defines each priority level and the targeted initial response time. "Initial Response" means an acknowledgment and triage of the issue by a qualified technician — not necessarily full resolution.

2. Plan-Based Emergency Response and Scheduling Matrix

The initial response targets above represent best-case benchmarks. Guaranteed contractual response commitments vary by the Client's active service plan tier:

3. Support Hours

Standard Business Hours: Monday through Friday, 8:00 AM to 6:00 PM Eastern Time (ET), excluding major US Federal holidays and the following observed holidays: New Year's Day, Memorial Day, Independence Day, Labor Day, Thanksgiving Day, and Christmas Day.

After-Hours Coverage: P1 (Critical) issues are handled 24/7/365 for eligible plan tiers (eSmith ProCare). For all other plan tiers, non-critical tickets received after standard business hours will be triaged and queued for the following business morning. Emergency after-hours service for non-ProCare clients is available at the published emergency hourly rate.

4. Backup Integrity and Recovery Objectives

Where backup services are included or contracted as part of the Client's service plan:

• Local Backup Frequency: Up to every 15 minutes for supported systems (e.g., Datto, Veeam).
• Cloud/Offsite Backup Frequency: Daily replication of local backup snapshots to a geographically separated data center.
• Recovery Time Objective (RTO): The target time to restore a critical server from backup is 4 hours for local recovery and 24 hours for cloud-only recovery, subject to data volume and infrastructure complexity.
• Recovery Point Objective (RPO): The maximum acceptable data loss window is defined by the backup frequency — typically 15 minutes for local and 24 hours for cloud-only configurations.

Backup frequency, RTO, and RPO targets are subject to the Client's specific backup solution, data volume, and infrastructure. Exact values will be documented in the Client's onboarding technical intake.

5. Client Obligations

To enable eSmith IT Consulting to meet the response targets and service commitments defined in this SLA, the Client agrees to:

1. Use Official Support Channels: All support requests must be submitted through the official ticketing system, help desk email, or designated phone number. Requests sent via personal text message, social media, or informal channels are not trackable and are not subject to SLA response guarantees.
2. Designate a Main Point of Contact: The Client must maintain a designated Main Point of Contact and Emergency Contact who are authorized to approve emergency expenses, grant after-hours access, and make binding operational decisions on behalf of the organization.
3. Maintain Hardware Warranties: The Client is responsible for maintaining active manufacturer warranties on all critical infrastructure hardware (servers, firewalls, switches, and UPS systems). eSmith IT is not liable for delays caused by failed hardware that is out of warranty.
4. Cooperate with Security Policies: The Client and all of its employees must comply with security policies communicated by eSmith IT, including enforcing MFA, completing phishing awareness training, and immediately reporting suspected security incidents.