Offensive Security Services

1 · Parties & Effective Date

This Master Service Agreement ("MSA") is between ("Client") and REDTEAM ("Service Provider"). It takes effect on the date of last signature ("Effective Date").

2 · Purpose

The Client may engage the Service Provider for offensive security services from time to time. Each engagement is defined by a signed Statement of Work (SOW) and governed by this MSA, the Rules of Engagement, the Authorization Form, the NDA, and the Data Processing Agreement (where applicable). In the event of conflict, the order of precedence is: Authorization Form, Rules of Engagement, SOW, this MSA, NDA, DPA.

3 · Services & Engagement Documents

• Services are performed only after a signed SOW and written authorization for the targets involved.
• All testing follows the Rules of Engagement and the proof-of-concept-only, no-destruction principles.
• The Service Provider is an independent contractor; nothing in this MSA creates an employment, agency, or partnership relationship.

4 · Term & Renewal

This MSA begins on the Effective Date and continues until terminated by either Party on days' written notice. Termination of this MSA does not automatically terminate an active SOW; active engagements continue under their terms unless otherwise agreed.

5 · Fees & Payment

• Fees are stated in each SOW in Malaysian Ringgit unless otherwise agreed.
• Invoices are payable within days of invoice date.
• Deliverables are licensed to the Client once fees for the relevant SOW are paid in full.

6 · Client Obligations

• Provide accurate scope information, access, credentials (where agreed), and a single point of contact.
• Ensure the Client has lawful authority to authorize testing of all targets listed in the Authorization Form.
• Provide a testing window and notify the Service Provider of any constraints on availability or third-party dependencies.

7 · Confidentiality

The NDA governs confidentiality. All findings, evidence, reports, and engagement data are Confidential Information.

8 · Data Protection

Where the Service Provider processes personal data on behalf of the Client, the Data Processing Agreement applies, and both Parties comply with the Personal Data Protection Act 2010 (Malaysia) and any successor legislation.

9 · Intellectual Property

• Service Provider retains ownership of its methodology, tools, and pre-existing materials.
• Upon full payment, deliverables commissioned by the Client are licensed to the Client for internal security purposes; the Client may not redistribute them without consent.

10 · Warranties

• Each Party warrants it has the authority to enter this MSA.
• Service Provider warrants services will be performed with reasonable skill and care and in accordance with the engagement documents.
• Service Provider does not warrant that testing will detect all vulnerabilities.

11 · Limitation of Liability

Except for breaches of confidentiality, data protection obligations, or gross negligence, each Party's total liability under an engagement is limited to the fees paid or payable for that engagement. Neither Party is liable for indirect, incidental, or consequential damages.

12 · Indemnification

Each Party indemnifies the other against third-party claims arising from its breach of this MSA, its negligence, or its violation of law in performing its obligations.

13 · Insurance

Service Provider maintains professional liability and cyber insurance at levels and provides certificates of insurance upon request.

14 · Termination

Either Party may terminate this MSA for material breach not cured within days of written notice. Upon termination, outstanding fees become due, and each Party returns or destroys the other's Confidential Information per the NDA.

15 · Force Majeure

Neither Party is liable for delay or failure caused by events beyond its reasonable control, including natural disasters, acts of government, or network outages, provided the affected Party notifies the other promptly.

16 · Governing Law & Dispute Resolution

This MSA is governed by the laws of Malaysia. Disputes are first referred to good-faith negotiation; failing resolution, to mediation; and failing that, to the courts of Malaysia.

17 · General Provisions

• Entire agreement: This MSA and the engagement documents form the entire agreement and supersede prior discussions.
• Notices: In writing to the registered addresses or agreed emails of the Parties.
• Assignment: Neither Party assigns this MSA without the other's written consent.
• Severability: An unenforceable provision is severed; the remainder continues in effect.
• Waiver: A waiver of any term is not a waiver of any other or later breach.

18 · Signatures

The Parties execute this MSA by their authorized representatives.

COMPANY STAMP