Master Services Agreement

Baseline Telemetry Advisory is the trading name of the practice.

This page sets out the standard terms Baseline Telemetry Advisory uses for paid engagements. It is the reference version. The signed Master Services Agreement ("MSA") issued for an engagement, together with each Statement of Work and the Data Processing Agreement, forms the contract. Where a signed MSA differs from this page, the signed MSA prevails.

Structure of the agreement

• MSA. Commercial and legal terms that apply to every engagement.
• Statement of Work (SOW). Scope, deliverables, delivery mode, fees, and dates for a specific piece of work. See the SOW template.
• DPA. Processor terms where Baseline Telemetry Advisory processes personal data on the client's behalf.

Order of precedence, highest first: the signed SOW (for scope and fees only), the DPA (for data protection only), then the MSA. No purchase order, portal click-through, or supplier terms attached to an invoice varies the MSA unless both parties sign an amendment.

Services and delivery modes

Baseline Telemetry Advisory provides information security, cyber risk, and GRC advisory services, including virtual CISO support, framework readiness, risk and control work, policy development, vendor review, and incident and continuity preparation. Each SOW states the delivery mode:

• Mode A. Work is carried out in the Baseline Telemetry Advisory delivery workspace and handed over as structured exports (PDF, XLSX, DOCX, ZIP).
• Mode B. Work is carried out directly inside the client's own platforms under scoped, time-bounded, least-privilege access granted by the client.

On the Baseline Telemetry Advisory website these are described in plain language: Mode A is "we run delivery in our workspace" and Mode B is "we work embedded in your tools". The contractual terms in this agreement and in each SOW govern.

No certification, no audit, no legal advice

This clause is central and is not negotiable in substance.

• Baseline Telemetry Advisory is not a certification body, accredited registrar, or licensed CPA firm. It does not issue SOC 2 reports, ISO 27001 certificates, or any attestation, and cannot influence the outcome of an audit or certification decision.
• Readiness work prepares the client for an assessment carried out by an independent auditor or certification body appointed by the client. A successful audit outcome is not promised, warranted, or guaranteed.
• Advisory output, including risk assessments, policies, control mappings, and gap analyses, is professional guidance based on information the client supplies. It is not legal advice, tax advice, or an insurance or regulatory opinion. The client remains responsible for its own legal and regulatory compliance and for decisions taken on the basis of the work.
• Testing performed is documentary and configuration review unless a SOW expressly scopes technical testing. Baseline Telemetry Advisory does not perform penetration testing, red teaming, or vulnerability exploitation unless a SOW says so and the client provides written authorisation.

Client responsibilities

• Provide accurate and complete information, and a named engagement contact with authority to make decisions.
• Own and approve all deliverables before they are relied on or shared with an auditor, customer, or regulator.
• For Mode B, grant only the access the SOW requires, keep its own change control and approval process in force, and revoke access at engagement close.
• Hold all licences and authorisations for third-party platforms Baseline Telemetry Advisory is asked to work in, and confirm that its own terms with those providers allow named external access.

Personnel and subcontracting

Services are delivered by Baseline Telemetry Advisory personnel. Baseline Telemetry Advisory may engage a named subcontractor with the client's prior written consent and remains responsible for that subcontractor's work and for equivalent confidentiality and data-protection obligations. Nothing in the MSA creates employment, partnership, joint venture, or agency between the parties.

Use of AI tools

Baseline Telemetry Advisory may use managed AI and coding assistants for limited internal research, drafting, coding, and analysis. They are not a routine route for client workspace content, and we do not intentionally submit client secrets, credentials, raw evidence, sensitive personal data, or confidential engagement material. This use does not reduce Baseline Telemetry Advisory's confidentiality or data-protection obligations. The client may require AI-assisted processing to be excluded from its engagement in writing.

AI-assisted outputs are reviewed by Baseline Telemetry Advisory before delivery. Clients may request that AI-assisted processing be excluded from their engagement.

A managed transactional email provider sends authentication messages, invitations, booking confirmations, reminders, and operational notifications.

Fees, expenses, and taxes

Fees are stated in the SOW, exclusive of VAT or equivalent sales tax. Invoices are payable within 30 days. Late payment carries statutory interest under the European Communities (Late Payment in Commercial Transactions) Regulations. Pre-approved expenses are recharged at cost. Work paused for client delay beyond 30 days may be rescheduled and re-quoted.

Intellectual property

• Baseline Telemetry Advisory background IP. Methodology, templates, control libraries, question sets, tooling, and the workspace remain Baseline Telemetry Advisory property.
• Client materials. Everything the client supplies remains client property.
• Deliverables. On full payment, the client receives a perpetual, worldwide, royalty-free licence to use, modify, and share the deliverables for its own business, including with its auditors, customers, and regulators. Baseline Telemetry Advisory keeps the right to reuse its background IP and generic know-how.
• Baseline Telemetry Advisory will not name the client publicly, or use its logo, without prior written consent.

Confidentiality

Each party keeps the other's confidential information confidential, uses it only to perform or receive the services, restricts it to personnel who need it, and returns or deletes it on request subject to retention obligations. The duty survives for five years after the engagement ends, and indefinitely for information that is a trade secret. Disclosure compelled by law or a regulator is permitted, with notice to the other party where lawful.

Data protection and security

Where Baseline Telemetry Advisory processes personal data on the client's behalf, the DPA applies and forms part of the MSA. Security measures are set out in Annex II of the DPA. Personal data breach notification runs to the client without undue delay and in any event within 72 hours of Baseline Telemetry Advisory becoming aware.

Insurance

Baseline Telemetry Advisory arranges professional indemnity insurance covering advisory negligence, together with cyber liability and public liability cover, before work begins on a signed engagement, at the levels stated in the SOW cover sheet, and maintains it for the engagement's duration. Cover is not held on a standing basis ahead of a signed contract. A certificate of currency is provided once bound, and again on request. Baseline Telemetry Advisory will notify the client if cover lapses during an engagement.

Warranties

Baseline Telemetry Advisory warrants that the services will be performed with the reasonable skill and care of a competent professional in the field, by suitably qualified personnel. Except for that warranty, and to the extent permitted by law, all implied warranties are excluded, including merchantability, fitness for a particular purpose, and any warranty of a specific compliance, audit, or certification outcome. The client's remedy for a breach of the skill and care warranty is re-performance of the affected work, or a refund of the fees for that work where re-performance is not practicable, provided the client notifies Baseline Telemetry Advisory within 60 days of delivery.

Limitation of liability

• Neither party is liable for indirect, incidental, special, or consequential loss, loss of profit, revenue, anticipated savings, goodwill, business opportunity, or loss or corruption of data caused other than by that party's breach.
• Baseline Telemetry Advisory's total aggregate liability arising out of or in connection with the engagement, whether in contract, tort (including negligence), or otherwise, is capped at the greater of the fees paid under the relevant SOW in the 12 months before the claim, or EUR 50,000, unless the SOW sets a different cap.
• Regulatory fines, penalties, and enforcement costs imposed on the client by its own regulator are excluded, except to the extent directly caused by Baseline Telemetry Advisory's wilful misconduct.
• Nothing limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, wilful misconduct, or any liability that cannot lawfully be limited. Data-protection liability between the parties follows the DPA and applicable law.

Indemnities

The client indemnifies Baseline Telemetry Advisory against third-party claims arising from client materials that infringe third-party rights, from client instructions that breach law, and from access the client grants to a platform where it did not hold the right to grant it. Baseline Telemetry Advisory indemnifies the client against third-party claims that a deliverable, as delivered by Baseline Telemetry Advisory, infringes that third party's intellectual property.

Term, suspension, and termination

• The MSA runs until terminated. Each SOW runs for the term stated in it.
• Either party may terminate for convenience on 30 days' written notice; the client pays for work performed and committed to the date of termination.
• Either party may terminate immediately for material breach not cured within 30 days of notice, or on insolvency of the other party.
• Baseline Telemetry Advisory may suspend work for non-payment more than 30 days overdue, or where continuing would require it to act unlawfully or unethically.

Handover on exit

On termination or expiry, Baseline Telemetry Advisory provides a handover bundle of the client's current deliverables and evidence index, and revokes any Mode B access within two business days. The client can export its workspace data for 30 days, after which data is deleted or returned at the client's choice. Deletion requests are honoured except where law, accountability under GDPR art. 5(2), or a litigation or regulatory hold requires us to keep specific records. Retention detail is in the DPA.

Force majeure

Neither party is liable for delay or failure caused by an event beyond its reasonable control, including infrastructure provider outage, provided it notifies the other party and works to resume performance. Payment obligations already accrued are not suspended.

Dispute resolution, governing law, and jurisdiction

The parties will first escalate a dispute to a senior representative on each side and attempt resolution within 30 days, then may refer it to mediation before starting proceedings. This does not prevent either party seeking urgent injunctive relief. The MSA is governed by the laws of Ireland, and the parties submit to the exclusive jurisdiction of The courts of Ireland. The services are supplied business to business; consumer protection legislation does not apply.

General

Notices are given in writing to legal@btadvisory.io and to the client's named contact. Neither party may assign the MSA without consent, except to a successor of its business. If a clause is unenforceable, the rest stands. The MSA, the SOWs, and the DPA are the entire agreement between the parties on their subject matter. No third party has rights under the MSA.

Requesting the executable version

For the signature-ready MSA, SOW cover sheet, and DPA as a single pack, email legal@btadvisory.io. Related pages: Statement of Work template, Terms of Service, Data Processing Agreement, Privacy Policy.