MSP Channel Partner Agreement

Effective Date: 11 August 2026

Next Scheduled Review: 11 August 2027

Introduction

This MSP Channel Partner Agreement (this "Agreement") is made between ConvergeRisk Pty Ltd (ABN 90 676 967 061), trading as Abilay ("Abilay", "we", "our", or "us"), an Australian private company of Brisbane, Queensland, and the Managed Service Provider identified in the acceptance record captured at onboarding (the "MSP", "you").

A "Managed Service Provider" ("MSP") is a business that manages information technology and security services on behalf of its own clients. Clause 5 of the Abilay Terms of Use, published at abilay.com/terms (the "Terms of Use"), contemplates that MSP access "may be subject to additional commercial terms agreed separately with Abilay." This Agreement is those additional commercial terms and is to be read together with the Terms of Use.

Abilay appoints the MSP as a non-exclusive channel partner to introduce, provision, and manage the Abilay cyber security capability Software-as-a-Service platform (the "Platform") for the MSP's own Small and Medium-sized Business ("SMB") clients (each an "End Client"). The parties intend an agency and channel relationship, not a reseller relationship: Abilay is the principal provider of the Platform and the MSP earns channel margin. Nothing in this Agreement transfers ownership of the Platform, any End Client account, or any certification licence to the MSP. The accepting individual warrants that they are authorised to bind the MSP.

1. Appointment and Nature of the Relationship

1.1 Abilay grants the MSP a non-exclusive, non-transferable right to market and provision the Platform to End Clients during the Term, subject to this Agreement and the Terms of Use.

1.2 The MSP acts as principal in its own dealings with its End Clients for the managed services the MSP itself supplies. The MSP is not Abilay's agent for any purpose and has no authority to make representations, warranties or commitments on Abilay's behalf, or to bind Abilay.

1.3 This is not a reseller-of-licence arrangement. The MSP does not purchase Platform licences at wholesale for resale under its own name. Consistent with clause 15 of the Terms of Use, the MSP must not resell, sublicense or publicly distribute the documents, templates, policy suites, control configurations and related outputs made available through the Platform (the "Materials") except as expressly permitted here.

1.4 Nothing in this Agreement creates a partnership, joint venture, or employment relationship between the parties.

2. Licence Sovereignty

2.1 Each End Client's Platform account, Information Security Management System ("ISMS") and any certification licence remain the property of that End Client and sit under the End Client's own Business Registration Number — the number under which the entity is registered in its home jurisdiction (for example, an Australian Business Number, a New Zealand Business Number, or the equivalent company registration number elsewhere) — and not the MSP's and not Abilay's. This principle ("Licence Sovereignty") mirrors clause 5 of the Terms of Use.

2.2 The MSP must not represent to any End Client or third party that the MSP holds, owns, or controls the End Client's account, ISMS, certification, or licence status.

2.3 On expiry or termination of this Agreement, or of the MSP's relationship with an End Client, the End Client retains its account, ISMS and licence intact under its own Business Registration Number. Licence Sovereignty survives termination (clause 14).

3. SMB1001 Alignment — Not Certification

3.1 Abilay is an independent cyber security capability Software-as-a-Service platform. Abilay is not a Conformity Assessment Body ("CAB"), a certifier, or a certification body recognised by Dynamic Standards International ("DSI"), and holds no DSI role in respect of certification. The Platform supports implementation of controls aligned with SMB1001; it does not issue SMB1001 certification.

3.2 Certification outcomes, where sought, are obtained by the End Client through an appropriate DSI-recognised body, under the End Client's own Business Registration Number. The MSP must not state or imply that Abilay, or the MSP by virtue of using the Platform, certifies SMB1001 conformance.

3.3 SMB1001 is a specification only; it does not supply templates. Policies, procedures and registers generated by the Platform are Abilay's output, not the content of the standard.

4. Commercial Model

4.1 The economics of this Agreement are set out in Schedule 1 (Commercial Terms). In summary: Abilay retains the tier Recommended Retail Price ("RRP") as a wholesale floor; the MSP sets its own price to the End Client at or above RRP; and the margin above RRP is shared between the parties according to the MSP's cohort.

4.2 The MSP's cohort and its resulting split are recorded against the MSP's Platform account and displayed in the MSP portal. For Founding-50 MSPs, the split is locked at the first completed sale and applies for so long as the MSP's account remains open, as described in Schedule 1 and clause 13.4.

4.3 The RRP for each tier is as published at abilay.com and in the Rate Card (the commercial collateral provided to the MSP). Abilay may change RRPs prospectively; changes do not affect the price already agreed for an End Client's current subscription term.

5. Payment and Settlement

5.1 Payments are processed through Stripe Connect. Charges are collected to Abilay's platform account, and the MSP's share is settled to the MSP's connected account. In local-settlement corridors, Abilay may settle on the MSP's behalf so that the MSP is the business of record for that charge.

5.2 The MSP must complete Stripe Connect Express onboarding, including identity and payout verification, before it can receive settlement. The MSP's connected account is governed by, and the MSP accepts through Connect onboarding, the applicable Stripe service agreement — the Stripe Connected Account Agreement (for a full service agreement) or the Stripe Recipient Agreement (for a recipient service agreement). The service-agreement type cannot be changed once accepted, so the MSP is onboarded under the configuration appropriate to its settlement corridor.

5.3 The MSP is solely responsible for its own taxes, including Goods and Services Tax where applicable, on the amounts it charges its End Clients and on its margin. Abilay is responsible for tax on the amounts it retains.

6. Data Separation and Multi-Tenant Use

6.1 Abilay's multi-tenant architecture maintains strict separation between MSPs' client data. The MSP must not access, query, or export data belonging to any organisation other than its own End Clients.

6.2 The MSP must ensure its personnel access the Platform only through credentials and methods provided by Abilay, and must comply with the human-only signup and Application Programming Interface ("API") conditions in clauses 3 and 6 of the Terms of Use.

7. Data Protection

7.1 The Privacy Statement published at abilay.com/en/privacy (the "Privacy Statement") applies to this Agreement and is incorporated by reference.

7.2 Roles. Abilay is the controller of personal information it processes to operate and secure the Platform, including account, authentication and telemetry data, as described in the Privacy Statement. For personal information that the MSP or its End Clients place into or process through the Platform for their own governance, risk and compliance purposes — including End Client staff-compliance records — the MSP or the relevant End Client is the controller (and, under regimes that use that designation, the Data Fiduciary), and Abilay acts as processor on their documented instructions. Consistent with Licence Sovereignty, Abilay does not assume, and cannot be delegated, the End Client's data-protection responsibility for that information.

7.3 MSP obligations. In respect of personal information it or its End Clients place into the Platform, the MSP must: (a) ensure it has a lawful basis and has given any required notices or obtained any required consents; (b) comply with the Privacy Statement and applicable data-protection laws; (c) flow down equivalent privacy obligations to its End Clients; (d) not instruct Abilay to process personal information unlawfully; and (e) cooperate promptly with Abilay on data-subject requests and on notification of any personal-data breach.

7.4 Cross-border processing. Personal information is processed and stored as described in the Privacy Statement, in the region appropriate to the End Client's jurisdiction and applicable law — Australia by default, and in-region where required or appropriate (for example, India-based End Clients in the Amazon Web Services Mumbai region). Where a settlement or hosting corridor involves processing in another region, the parties give effect to the safeguards described in the Privacy Statement and any applicable data-transfer terms.

8. AI-Assisted Capabilities

8.1 The Platform may include AI-assisted generation and editing of content. AI is assistive only. The MSP must not describe Platform outputs to End Clients as "AI-generated," and must not present AI-assisted outputs as the sole basis for any compliance, regulatory or risk-critical decision.

8.2 AI-assisted outputs may contain errors or jurisdictional limitations. Abilay does not warrant their accuracy, consistent with clause 8 of the Terms of Use.

9. MSP Obligations and Conduct

9.1 The MSP must: (a) represent Abilay, the Platform and SMB1001 accurately and consistently with clauses 2 and 3; (b) not make misleading claims about certification, ownership, or Abilay's role; (c) comply with the Terms of Use and all applicable laws; and (d) ensure its End Client arrangements are consistent with this Agreement.

9.2 The MSP must not resell, redistribute, or publicly publish the Materials except to its own End Clients for their internal governance and compliance use, consistent with clause 15 of the Terms of Use.

10. Intellectual Property

10.1 The Platform and Materials remain the intellectual property of ConvergeRisk Pty Ltd, trading as Abilay, unless stated otherwise. The MSP receives a limited, non-exclusive, non-transferable licence to use and provision the Materials to its End Clients for legitimate governance and compliance activities only.

10.2 The MSP acquires no rights in Abilay's trade marks or branding beyond use reasonably necessary to market the Platform during the Term, and must cease such use on termination.

11. Confidentiality

11.1 Each party must keep the other's confidential information confidential and use it only for the purposes of this Agreement, except where disclosure is required by law. Commercial terms in Schedule 1 are Abilay's confidential information.

12. Warranties, Liability and Indemnity

12.1 The Platform and Materials are provided "as is" and "as available" without warranties of any kind, consistent with clause 12 of the Terms of Use.

12.2 To the maximum extent permitted by law, and where liability cannot be excluded it is limited to the total amounts paid by or to the MSP under this Agreement in the 12 months preceding the claim, neither party is liable for indirect or consequential loss. Nothing limits liability that cannot lawfully be limited, including under the Australian Consumer Law.

12.3 The MSP indemnifies Abilay and ConvergeRisk Pty Ltd against claims arising from the MSP's misrepresentations to End Clients, breach of this Agreement, or misuse of the Platform or Materials.

13. Term and Termination

13.1 This Agreement begins on acceptance and continues for an initial term of 12 months, renewing automatically for successive 12-month terms unless terminated.

13.2 Either party may terminate for convenience on 30 days' written notice, and immediately for material breach not remedied within 14 days of notice.

13.3 On termination: (a) the MSP's right to make new sales ceases; (b) each End Client retains its account, ISMS and licence under its own Business Registration Number (clause 2); (c) accrued amounts are settled; and (d) the MSP ceases use of Abilay branding.

13.4 Founding-50 places — finite and non-replenishing. The Founding-50 cohort comprises a fixed pool of fifty (50) places. Each place carries the locked 80/20 split (clause 4.2, Schedule 1) and attaches to the MSP entity holding it for so long as that entity's account remains open. If a Founding-50 MSP closes its account, its place is permanently forfeited: it is not reallocated to any other entity, the pool does not replenish to fill it, and that MSP may not subsequently re-enter the Founding-50 or resume the 80/20 split. An MSP returning after closure is onboarded as a Standard MSP. The number of Founding-50 places in effect can therefore only decrease over time.

14. Survival, Changes and General

14.1 Clauses 2 (Licence Sovereignty), 3, 7, 10, 11, 12 and 14 survive termination.

14.2 Abilay may update this Agreement from time to time. Material changes will be notified via the Platform or by email, and continued transacting after the effective date, or re-acceptance where prompted, constitutes acceptance — consistent with clause 17 of the Terms of Use.

14.3 The MSP may not assign this Agreement without Abilay's written consent. Abilay may assign to a related entity or successor. If any provision is unenforceable, the remainder continues in effect.

14.4 This Agreement, together with the Terms of Use and Schedule 1, is the entire agreement between the parties on this subject. Where this Agreement and the Terms of Use conflict on commercial matters, this Agreement prevails; on Platform-use and conduct matters, the Terms of Use prevail.

15. Governing Law

15.1 This Agreement is governed by the laws of Queensland, Australia, without excluding mandatory consumer protections applicable elsewhere. The parties submit to the courts of that jurisdiction.

16. Acceptance

This Agreement is accepted electronically. The acceptance record captured by the Platform — the accepting user, the entity, the Agreement version, the document hash, and the timestamp — is the record of execution and is admissible as evidence of the MSP's agreement to these terms.

Schedule 1 — Commercial Terms

S1.1 Margin structure

Abilay retains the tier RRP as a wholesale floor. The MSP prices to the End Client at or above RRP. Margin above RRP is shared by cohort:

• The Founding-50 is a finite pool of fifty (50) places that does not replenish. A place attaches to the MSP entity holding it and applies while that entity's account remains open.
• "Locked at first completed sale" means the 80/20 split is fixed to the value recorded against the MSP account when its first End Client sale completes. On account closure the place is permanently forfeited, is never reallocated, and cannot be resumed — a returning MSP is onboarded as Standard (70/30). The number of places in effect can only decrease over time (clause 12.4).

S1.2 Tiers and RRP

Tier RRPs are as published at abilay.com and in the Rate Card. Per-tier dollar values are intentionally carried in the Rate Card, not this Schedule, so that an RRP change does not require re-execution of this Agreement.