THESE “AVANAN INCIDENT RESPONSE SERVICES’ TERMS OF SERVICE” IS AN AGREEMENT (“INCIDENT RESPONSE SERVICES AGREEMENT”) ENTERED INTO BETWEEN THE CUSTOMER (“CUSTOMER”) SUBSCRIBING TO THE INCIDENT RESPONSE SERVICES (AS DEFINED BELOW) REFERENCING THIS INCIDENT RESPONSE SERVICES AGREEMENT (EACH A “SUBSCRIPTION ORDER”) AND AVANAN, INC., A DELAWARE CORPORATION WITH OFFICES AT 259 WEST 30TH STREET NEW YORK, NY 10001 (“AVANAN”). BY SUBSCRIBING TO THE INCIDENT RESPONSE SERVICES, YOU HEREBY AGREE TO THE TERMS OF THIS INCIDENT RESPONSE SERVICES AGREEMENT.
1. DEFINITIONS
“Documentation” means this Incident Response Services Agreement, the Subscription Order, and other user documentation related to the use or operation of the Incident Response Services, each as made available by Avanan electronically via the Incident Response Services or otherwise in writing.
“Incident Response Services” means the services described in the Subscription Order (including any updates thereto provided by Avanan in its sole discretion) and the Documentation.
2. TOS AND PRIVACY POLICY INCORPORATION
This Incident Response Services Agreement incorporates by reference (i) Avanan's Terms of Service (“TOS”), at: https://www.avanan.com/avanan-terms-of-service, and (ii) Avanan's Privacy policy (“Privacy Policy”), at: http://www.avanan.com/privacy-policy, which both constitute an integral part of this Incident Response Services Agreement. Any capitalized terms not defined herein shall have the meaning ascribed to them in Avanan's TOS.
The terms and conditions of the TOS and Privacy Policy will apply, mutatis mutandis, to the Incident Response Services and to the Subscription Order, as applicable. In the event of a contradiction between this Incident Response Services Agreement and the TOS and/or Privacy Policy, this Incident Response Services Agreement shall prevail and govern.
3. SLA
SLA As part of the Incident Response Services, Customer administrators and end-users will generate, through the Avanan portal and the SaaS product Avanan secures (“Ticket”):
- End-user requests to release messages from quarantine (False-positives)
- End-user reports of missed attacks (False-negatives)
Avanan will process the request by its team of professional Security Analysts and will resolve the incident within 30 minutes (“SLA Time”), by accepting or denying the request, based on its security analysis.
Avanan is committed to meet SLA Time in 95% of Customer Tickets, and 100% of Tickets within 24 hours (“Service Level”).
If during the period of a given month, Avanan fails to meet the Service Level, customer shall be entitled to a service fee discount, based on the following schedule:
- 5%-10% of Tickets not resolved within the Service Level: 25% discount of monthly fee.
- 10%-20% of Tickets not resolved within the Service Level: 50% discount of monthly fee.
- More than 20% of Tickets not resolved within the Service Level: 100% discount of monthly fee.
4. INCIDENT RESPONSE SERVICES LICENSE
Subject to the terms of this Incident Response Services Agreement and subject to the payment of any applicable fees, Avanan grants Customer, during the subscription term specified in the Subscription Order, a non-exclusive, non-transferable, non-sublicensable, revocable and limited license to access and use the Incident Response Services, solely for Customer’s internal use, and in accordance with the documentation, whereas in connection with such use, Customer shall have the right to allow its employees and contractors, which are directly associated with the performance of Customer's business, to use the Incident Response Services solely on Customer’s behalf.
5. PRIVACY
The Incident Response Services include having humans review emails and are delivered by Avanan employees. All Avanan employees, and particularly the Avanan Security Analysts that provide these services, are required to pass a background check prior to hiring and an annual data-privacy and security training for their entire employment period. Additional safeguards and procedures implemented by Avanan for the protection of its customers’ data are detailed in Avanan’s SOC2 - Type II report, that is annually audited and signed by an external auditor and is available to share upon request.
Avanan is subject to a Non-Disclosure Agreement and Data Protection Agreement, including Contractual Clauses for personal data transfer. Specifically, Avanan is contractually committed not to share any Customer information made available to it or its employees with any third party. Avanan is also contractually committed to make no use of the data except for the purpose of providing and improving this service.
To provide 24/7 support, Avanan deploys two shifts, split between Avanan’s New-York team based in the United States and Avanan’s Tel-Aviv team based in Israel. Customers may select to geo-restrict access to their data and limit access to only one of those teams. For such Customers , Avanan will not store any customer data, such as email or their content, and after the review of the email is complete, all email content will be discarded from the systems used for providing this service. The only information to reside after an analysis has been completed, is the data relating to the performance of the Avanan analysts, such as their name, process time, verdict, etc., and only for the purpose of measuring performance, meeting the Service Level and improving the service.
6. TERMINATION
Without derogating from the provisions of the TOS and Privacy Policy, the termination of this Incident Response Services Agreement, by either party, will not be considered as termination of the TOS or any Order thereof. However, in the event of suspension and/or termination of the Services provided under the TOS or any Order thereof, this Incident Response Services Agreement and any Subscription Order thereof shall immediately be suspended and/or terminated (as applicable).