This Client Service Agreement ("CSA") is made between the Client and the vCISO identified in a specific project or booking on the TruCISO Platform. TruCISO is not a party to this agreement.
1. Services
The vCISO agrees to provide the cybersecurity consulting services as described in the service listing and any accompanying Statement of Work ("SOW") agreed upon by both parties on the Platform. Any changes to the Services or SOW must be agreed in writing via the Platform. The Client shall provide the vCISO with necessary access, information, and cooperation to perform the Services. The vCISO shall comply with applicable cybersecurity laws and standards (e.g., GDPR, CCPA, NIST) in performing the Services.
2. Fees and Payment
The Client agrees to pay the vCISO the fees specified in the SOW. All payments shall be made through the TruCISO Platform only. Payments are non-refundable, and must be made in full, prior to the execution of the work. The Platform may hold payments in escrow until milestones are met.
3. Confidentiality
Both parties agree to maintain the confidentiality of all proprietary or confidential information disclosed during the engagement ("Confidential Information"). Confidential Information includes business data, trade secrets, personal data, and cybersecurity assessments, but excludes information that is public or independently developed. Neither party shall disclose the other's Confidential Information to any third party without prior written consent, except as required by law. Obligations survive for 5 years post-termination. Upon termination, parties shall return or destroy Confidential Information. Breaches allow injunctive relief and damages.
4. Intellectual Property
Upon full and final payment for the services, all rights, title, and interest in and to the work product and deliverables created by the vCISO specifically for the Client under this CSA ("Deliverables") shall be owned by the Client. The vCISO retains ownership of pre-existing IP and grants the Client a non-exclusive, perpetual license to use it in connection with the Deliverables. Deliverables do not include pre-existing IP. The vCISO warrants that Deliverables do not infringe third-party IP.
5. Warranties
The vCISO represents and warrants that they will perform the Services in a professional and workmanlike manner, consistent with industry standards. THE VCISO MAKES NO OTHER WARRANTIES, EXPRESS OR IMPLIED. The Client warrants that information provided is accurate and complies with laws.
6. Term and Termination
This CSA commences on the date of project booking and continues until the Services are completed. Either party may terminate this agreement if the other party commits a material breach and fails to cure such breach within 30 days after written notice. Upon termination, the Client pays for completed Services; parties fulfill surviving obligations (e.g., confidentiality).
7. Independent Contractor Status
The vCISO is an independent contractor, not an employee. No agency or partnership is created.
8. Limitation of Liability
Neither party is liable for indirect damages (e.g., lost profits). Liability capped at fees paid.
9. Indemnification
Each party indemnifies the other for breaches of warranties or IP infringement.
10. Data Security and Privacy
The vCISO shall use industry-standard security measures. Parties comply with data protection laws.
11. Insurance
The vCISO maintains cyber liability insurance.
12. Governing Law and Dispute Resolution
This Agreement shall be governed by and construed in accordance with the laws of Singapore. If there are disputes, differences and/or claims arising in connection with this Agreement, then at the first level it will be resolved by deliberation within a period of 30 days and if no deliberative settlement is reached, then the Parties agree to resolve it through the Singapore International Arbitration Centre ("SIAC") domiciled in Singapore. The settlement process through SIAC is subject to the SIAC Arbitration Rules ("SIAC Rules") for the time being in force, which are deemed to be an inseparable part of this Article. The arbitration proceedings will be conducted in English.
13. Force Majeure
Neither party is liable for delays due to unforeseen events beyond their control.
14. Entire Agreement
This CSA supersedes prior agreements.
15. Non-Solicitation
The Client shall not solicit or hire the vCISO for direct employment for 12 months post-engagement.