Master Services Agreement

Parties & Effective Date

This Master Services Agreement (the 'Agreement') is entered into between Chisu Technologies, a company organized under the laws of British Columbia, Canada ('Chisu', 'we', 'us'), and the individual or legal entity identified at Stripe checkout ('Client', 'you'). The Agreement becomes effective on the date Client clicks 'I accept' and completes the linked Stripe payment ('Effective Date').

By accepting, Client represents that the individual completing checkout has authority to bind the Client entity to this Agreement.

Scope of Services

Chisu will deliver the engineering sprint corresponding to the SKU purchased at checkout (Sprint 1 week, Sprint 2 weeks, or Sprint 4 weeks). The scope, deliverables, and milestone schedule are described in the Statement of Work ('SOW') generated automatically upon checkout and attached to the welcome email sent to Client.

Sprint 2-week and Sprint 4-week engagements include, at no additional cost, an authenticated deep-scan bundle — OWASP ZAP with credentialed session, semgrep or CodeQL static analysis on Client's repository, IaC scanning, cloud configuration review (Prowler or ScoutSuite), and authenticated DAST with role-comparison crawl — subject to Client providing the necessary credentials, repository access, and read-only cloud role under the Confidentiality section below.

Sprint 4-week engagements additionally include preparation of the three Chisu Templates (SOC2-lite Readiness Checklist, Incident Response Runbook, Lightweight STRIDE Threat Model) tailored to Client's stack.

Any work outside the SOW will be quoted separately and accepted in writing before commencement.

Term

The engagement begins on the kick-off date scheduled in the welcome email (typically within five (5) business days of the Effective Date) and continues for the duration purchased: seven (7), fourteen (14), or twenty-eight (28) calendar days.

Either party may extend the term by mutual written agreement.

Fees & Payment

Fees are the amount displayed at checkout, charged in full at the Effective Date through Stripe. Applicable taxes (GST and, where applicable, BC PST) are computed and collected by Stripe at checkout.

Fees are non-refundable once work has commenced, except as set out in the Termination section below.

Client Responsibilities

Client will (a) designate a single point of contact reachable on Slack or email during business hours, (b) provide timely access to systems, repositories, and stakeholders necessary for delivery, and (c) review and respond to deliverables and questions within two (2) business days of receipt.

Delays caused by Client's failure to meet these obligations may extend timelines and do not entitle Client to a refund.

Confidentiality

Each party agrees to keep confidential and not disclose to any third party any non-public information disclosed by the other party in connection with this Agreement, including source code, system credentials, customer data, and findings from the audit.

Confidentiality obligations survive termination of this Agreement for a period of five (5) years.

Confidential information does not include information that (a) is or becomes publicly available without breach of this Agreement, (b) was already known to the receiving party prior to disclosure, (c) is independently developed without use of the disclosing party's information, or (d) is required to be disclosed by law, provided the receiving party gives prompt notice.

Intellectual Property

Upon Client's full payment, Chisu assigns to Client all right, title, and interest in custom deliverables created specifically for Client under the SOW (the 'Deliverables').

Chisu retains all right, title, and interest in its pre-existing materials, methodologies, scanning tools, scoring system, and Chisu Templates (collectively, 'Chisu Materials'). Chisu grants Client a perpetual, non-exclusive, royalty-free, worldwide license to use Chisu Materials embedded in the Deliverables solely for Client's internal business operations.

Nothing in this Agreement transfers ownership of Chisu's trademarks, name, or branding.

Warranties & Disclaimers

Chisu warrants that services will be performed in a professional and workmanlike manner consistent with industry standards.

EXCEPT AS EXPRESSLY SET OUT IN THIS AGREEMENT, THE SERVICES AND DELIVERABLES ARE PROVIDED 'AS IS', AND CHISU DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.

No security audit, hardening sprint, or advisory engagement guarantees the absence of vulnerabilities or attacks. Client remains responsible for the security of its systems.

Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR IN CONNECTION WITH THIS AGREEMENT WILL NOT EXCEED THE TOTAL FEES PAID BY CLIENT TO CHISU UNDER THIS AGREEMENT.

The limitations above do not apply to (a) Client's payment obligations, (b) breach of confidentiality, or (c) indemnification obligations under this Agreement.

Termination

Either party may terminate this Agreement for material breach by the other party if such breach is not cured within ten (10) business days of written notice.

If Chisu terminates for Client's breach (including non-payment), all fees due are immediately payable.

If Client terminates without cause after kick-off, Chisu will retain fees for work performed and a pro-rata portion of remaining fees, not to exceed 50% of unperformed scope.

Sections on Confidentiality, Intellectual Property, Limitation of Liability, and Governing Law survive termination.

Governing Law & Dispute Resolution

This Agreement is governed by the laws of the Province of British Columbia, Canada, and the federal laws of Canada applicable therein, without regard to conflict-of-law rules.

The parties will first attempt to resolve any dispute through good-faith negotiation. If unresolved within thirty (30) days, the dispute will be submitted to the exclusive jurisdiction of the courts of Vancouver, British Columbia.

Miscellaneous

This Agreement (together with the SOW and Chisu's Terms of Service and Privacy Policy referenced at checkout) constitutes the entire agreement between the parties and supersedes all prior agreements regarding its subject matter.

No amendment is effective unless in writing and signed (digitally or otherwise) by both parties.

If any provision is held unenforceable, the remaining provisions will continue in full force and effect.

Notices must be sent to [email protected] (for Chisu) and to the email address provided at checkout (for Client).

Acceptance

Client's act of clicking 'I accept' on the post-checkout acceptance page, together with Stripe's record of payment and the timestamp and IP address logged by Chisu, constitutes Client's binding electronic signature to this Agreement, with the same legal effect as a handwritten signature.