MSP Partner Agreement

Effective Date: 9 July 2026

Next Scheduled Review: 1 November 2027

Introduction

This MSP Partner Agreement ("Agreement") is issued by Abilay, a registered business name of ConvergeRisk Pty Ltd (ABN 90 676 967 061) ("Abilay", "we", "our", or "us").

It sets out the terms on which a Managed Service Provider ("Partner", "MSP", "you") may distribute the Abilay platform to its Small and Medium-sized Business ("SMB") clients, manage cyber security control implementation on their behalf, and set its own client-facing pricing. It includes the commercial model, the Licence Sovereignty principle, and the ethical markup guiderails that govern Partner pricing conduct.

1. Who We Are

ConvergeRisk Pty Ltd, trading as Abilay, is headquartered in Queensland, Australia and operates globally. Abilay is an independent cyber security capability Software as a Service ("SaaS") platform providing cyber security controls aligned with the SMB1001 standard published by Dynamic Standards International ("DSI").

Abilay is not a Conformity Assessment Body ("CAB"), certifier, or DSI licence holder of any kind. Use of the platform does not constitute, and Abilay does not issue, SMB1001 certification.

2. Scope and Acceptance of This Agreement

This Agreement incorporates the Abilay Terms of Use published at abilay.com/en/terms, including the provisions on human-only signup, MSP partner and multi-tenant use, and API access. Where this Agreement and the Terms of Use conflict, this Agreement prevails for Partner-specific commercial matters; the Terms of Use prevail for all other platform use.

This Agreement commences when the Partner accepts it in the MSP Portal (or executes it in writing, whichever is earlier) and continues until terminated under Section 18. Acceptance may only be given by a person authorised to bind the Partner entity; within the platform, acceptance is restricted to the MSP owner role. The individual accepting warrants that they hold that authority.

All amounts are in United States Dollars ("USD"), unless otherwise stated.

3. Definitions

In this Agreement, unless the context requires otherwise:

• Client means an SMB end client of the Partner for whom the Partner manages platform access or cyber security control implementation;
• Client-Facing Price means the total annual price the Partner charges a Client for a platform tier or product, as set by the Partner in the MSP Portal;
• Gross Margin means the Client-Facing Price less the applicable RRP for the relevant tier or product;
• Licence Sovereignty means the principle described in Section 5: each Client's platform account, ISMS, and any certification licence belong to the Client's own legal entity, not to the Partner;
• MSP Portal means the partner-facing area of the platform through which the Partner manages Clients, pricing, activations, invoices, and payouts;
• Platform Fee means the fee retained by Abilay on Partner transactions, as set out in Section 20;
• RRP means the Recommended Retail Price for a tier or product as published in the MSP Portal at the time of the relevant transaction, including any purchasing-power-parity ("PPP") adjustment applied for the Client's country (Section 19); and
• Stripe Connect Account means the Stripe Connect Express account the Partner must establish and maintain to receive margin payouts.

4. Our Relationship

Abilay appoints the Partner as a non-exclusive reseller and managed service partner for the platform in the territories in which the Partner lawfully operates.

The Partner is an independent contractor. Nothing in this Agreement creates a partnership, joint venture, employment, or agency relationship. The Partner must not hold itself out as an agent of Abilay, DSI, or any certification body.

Abilay may appoint other partners, sell direct, and modify the platform, tiers, and RRPs at its discretion, subject to the pricing change notice in Section 8.

5. Licence Sovereignty

Each Client's platform account, ISMS, document suite, evidence, and any certification licence obtained by the Client belong to the Client's own legal entity, identified by its ABN (or equivalent business registration), and not to the Partner. This principle applies at every touchpoint, survives termination of this Agreement, and cannot be varied by any agreement between the Partner and a Client.

The Partner must not:

• represent to any Client that the Partner holds, owns, or controls the Client's certification, licence, or platform account;
• register, hold, or renew a Client's platform account or certification under the Partner's own ABN or entity;
• condition a Client's continued access to its own account, ISMS content, or evidence on remaining a client of the Partner; or
• withhold, delete, or degrade a Client's account or data on ending the Partner-Client relationship.

On termination of the Partner-Client relationship for any reason, the Client retains its account and may continue directly with Abilay or via another partner. Any change to who funds the subscription is handled through the platform's billing transition process; the Client's data, documents, and evidence are unaffected.

6. SMB1001 Alignment and Certification

The platform supports implementation of controls aligned with the SMB1001 standard. Certification, if sought, must be obtained by the Client through an appropriate DSI-recognised body.

The Partner must not state or imply, in any marketing, sales, quoting, invoicing, or client communication, that:

• Abilay or the Partner issues, grants, or guarantees SMB1001 certification;
• purchase of the platform is itself certification, or that certification is automatic on purchase;
• the Partner's price includes a "certification fee" payable to Abilay or DSI, where no such fee exists; or
• Abilay or the Partner holds any DSI role, licence, or accreditation that it does not hold.

The Partner must correct any such misrepresentation promptly on becoming aware of it and notify Abilay if the misrepresentation reached a Client.

7. Platform Access, Accounts and Data Separation

The Partner will be provisioned with role-based access (including owner, admin, staff, billing, and viewer roles). The Partner is responsible for assigning roles on least-privilege principles, removing access for departed personnel promptly, and all activity under its accounts.

Accounts are for natural persons only and must not be created by automated means, shared, or transferred, consistent with the Terms of Use.

The platform maintains strict multi-tenant data separation. The Partner must not attempt to access, query, or export data belonging to organisations that are not its Clients, and must not use one Client's data for the benefit of another without lawful authority.

API access, where granted, is subject to the Terms of Use and any published API documentation.

8. Commercial Model and Pricing

Pricing authority. The Partner sets the Client-Facing Price for each Client and tier, provided the Client-Facing Price is never below the applicable RRP (including any PPP adjustment for the Client's country). The platform enforces this floor technically; attempting to circumvent it is a material breach.

Revenue split. On each paid Client transaction, Abilay retains the applicable RRP plus the Platform Fee (Section 20), and the Partner receives the remainder of its Gross Margin as a net payout.

Payouts. Net margin is transferred to the Partner's Stripe Connect Account, typically within two (2) business days of successful payment. The Partner must complete Stripe Connect onboarding (charges and payouts enabled) before creating Client invoices or activations. Abilay is not responsible for delays attributable to Stripe, the Partner's bank, or incomplete onboarding.

Billing modes. The platform supports client-funded activation (the canonical path, in which the Client pays at checkout), MSP-funded billing, and direct billing. The mode used for each Client is recorded in the MSP Portal and determines the flow of funds; the revenue split above applies in each case.

Currency and PPP. RRPs are PPP-adjusted for the Client's country as published in the MSP Portal. Where a transaction settles in a currency other than AUD, the split is calculated in the settlement currency using the applicable exchange rate at settlement.

Changes. Abilay may vary RRPs, the Platform Fee, or tier composition on at least thirty (30) days' notice via the MSP Portal or email. Changes apply to transactions occurring after the effective date and do not retrospectively alter completed transactions. Renewals occurring after the effective date use the then-current RRP.

Taxes. The Partner is responsible for its own tax obligations on its margin, including GST registration, invoicing, and remittance where applicable, and for determining the GST treatment of its Client-Facing Price. Abilay is responsible for tax on amounts it retains.

Refunds and chargebacks. Where a Client payment is refunded or charged back, the corresponding margin payout is reversed or set off against future payouts. The Partner must cooperate with reasonable dispute-resolution requests.

9. Ethical Markup Guiderails

The margin model exists to reward Partners for genuine value delivered to Clients: deployment, configuration, ongoing management, support, and governance uplift. It is not a mechanism for extracting rents from Clients who lack the information to assess a fair price. This Section sets binding conduct standards for how the Partner prices and represents the platform.

Price floor and ceiling behaviour. The Client-Facing Price must never be below the applicable RRP. There is no fixed price ceiling; however, a Client-Facing Price exceeding the Excessive Markup Threshold in Section 21 triggers the review process below.

Value for margin. The Partner's Gross Margin must be referable to genuine services or value provided to the Client, which may include onboarding, control implementation, document tailoring, evidence management, staff compliance administration, support, monitoring, or bundled managed services. The Partner should be able to describe, if asked by the Client or Abilay, what its margin covers.

Prohibited pricing representations. The Partner must not:

• represent that the Client-Facing Price, or any component of it, is set, mandated, or required by Abilay or DSI when it is not;
• describe its margin as an "Abilay fee", "platform fee", "licence fee", "certification fee", or similar, or otherwise attribute its markup to a third party;
• misstate the RRP to a Client, or represent that no lower-priced path to the platform exists when direct or alternative-partner access is available;
• invent compliance deadlines, regulatory penalties, or certification lapses to create false urgency in support of a higher price;
• charge different Clients materially different prices for the same tier and service scope on the basis of protected attributes, or of a Client's inability to assess market pricing, rather than genuine differences in service scope; or
• bundle the platform in a way that conceals its existence or prevents the Client understanding what it has purchased and that the account is its own (Section 5).

Consumer law. The Partner must comply with the Australian Consumer Law, including the prohibitions on misleading or deceptive conduct (s18), false or misleading representations (s29), and unconscionable conduct (s20-22), and with equivalent consumer protection laws in any other jurisdiction in which it sells. Nothing in this Agreement authorises conduct that would contravene those laws.

Transparency to Clients. The Partner is not required to disclose its margin to Clients as a matter of course. The Partner must, however: identify the platform as Abilay (or the approved white-label brand) in Client-facing materials such that the Client can identify what product it holds; ensure invoices and quotes do not misattribute charges; and, on a Client's direct question, not misrepresent whether the price includes a Partner service margin.

Review and remediation. Abilay may monitor pricing patterns across the MSP Portal for compliance with this Section. Where a Client-Facing Price exceeds the Excessive Markup Threshold, or Abilay receives a credible Client complaint about pricing conduct, Abilay may ask the Partner to explain the service scope supporting the margin, and the Partner must respond within ten (10) business days. If the explanation is not reasonably satisfactory, Abilay may require remediation, which may include correcting representations, re-pricing future renewals, or (in serious cases) refunding amounts obtained through prohibited representations. Repeated or serious breaches of this Section are material breaches entitling Abilay to suspend or terminate under Section 18. Abilay's rights under this Section are protective of Clients and the integrity of the channel; they do not make Abilay responsible for the Partner's pricing.

10. Client Relationships and Conduct

The Partner is responsible for its own Client agreements, which must be consistent with this Agreement - in particular Licence Sovereignty (Section 5), the certification position (Section 6), and the pricing conduct standards (Section 9).

The Partner must pass through to Clients any platform terms Abilay reasonably requires, including the Terms of Use acceptance that occurs at Client account creation.

The Partner must not make claims about platform capability, security posture outcomes, insurance outcomes, or regulatory compliance outcomes beyond those in Abilay's published materials.

11. Branding and White-Label Use

Abilay grants the Partner a non-exclusive, revocable licence to use the Abilay name and marks solely to market and resell the platform in accordance with published brand guidelines.

Where the Partner uses the platform's white-label capability, Partner branding applied to portals and communications does not alter Licence Sovereignty, the identity of the issuing entity, or any obligation in Sections 5, 6, or 9.

The Partner must not register domains, business names, or marks confusingly similar to Abilay, DSI, or SMB1001.

12. Payment Infrastructure

The Partner must establish and maintain a Stripe Connect Account, complete identity verification, and keep payout details current. Stripe's own terms apply to that account.

The Partner must not use the payment infrastructure for any transaction other than genuine Client purchases of the platform and associated Partner services invoiced through the platform.

Abilay may withhold payouts where fraud, chargeback abuse, breach of Section 9, or unlawful activity is reasonably suspected, pending investigation.

13. Data Protection and Privacy

Each party must comply with the Privacy Act 1988 (Cth), including the Australian Privacy Principles, and any other applicable data protection laws, in respect of personal information handled in connection with this Agreement. Abilay's handling of personal information is described in the Abilay Privacy Statement.

The Partner must only handle Client personal information available through the platform for the purpose of providing services to that Client, and must notify Abilay without undue delay of any actual or suspected data breach affecting platform data.

14. Confidentiality

Each party must keep confidential the other's non-public information obtained under this Agreement, including commercial terms, fee structures, and platform technical details, and use it only for performing this Agreement. This obligation survives termination for three (3) years, and indefinitely for trade secrets.

15. Intellectual Property

All Materials, the platform, and associated intellectual property remain the property of ConvergeRisk Pty Ltd, trading as Abilay, as set out in the Terms of Use. Clients receive the licence described there; the Partner receives only the rights expressly granted in this Agreement.

The Partner must not resell, sublicense outside the platform's mechanisms, publicly distribute, or create derivative competing products from the Materials.

16. Warranties and Liability

The platform and Materials are provided "as is" and "as available". The Terms of Use provisions on no professional advice, AI-assisted capabilities, no warranties, and limitation of liability apply to the Partner's use and are incorporated here.

To the maximum extent permitted by law, neither party is liable to the other for indirect or consequential loss. Abilay's aggregate liability under this Agreement is limited to the Platform Fees retained by Abilay from the Partner's transactions in the twelve (12) months preceding the claim. Nothing limits liability that cannot lawfully be limited, including non-excludable consumer guarantees.

17. Indemnity

The Partner indemnifies Abilay and ConvergeRisk Pty Ltd against claims, losses, and costs arising from: the Partner's breach of Sections 5, 6, or 9; representations the Partner makes to Clients beyond Abilay's published materials; the Partner's Client agreements and pricing conduct; and the Partner's breach of law. This indemnity is reduced to the extent Abilay caused the relevant loss.

18. Suspension and Termination

Either party may terminate for convenience on sixty (60) days' written notice.

Abilay may suspend Partner access immediately, or terminate on notice, for: material breach not remedied within fourteen (14) days of notice; breach of Sections 5, 6, or 9 that is serious or repeated; suspected fraud or unlawful conduct; insolvency; or circumvention of platform pricing or verification controls.

Effect on Clients. Termination of this Agreement does not terminate Client accounts. Consistent with Licence Sovereignty, each Client retains its account, data, documents, and evidence, and may continue directly with Abilay or through another partner. Abilay may contact the Partner's Clients directly to manage the transition.

On termination: accrued payout entitlements for completed transactions are paid in the ordinary course (subject to Section 12); the Partner's portal access and brand licence end; and Sections 5, 9 (remediation), 13 to 17, and 22 survive.

19. Tier RRPs

The authoritative RRP for any transaction is the RRP published in the MSP Portal at the time of the transaction, including any PPP adjustment for the Client's country. The following Australian baseline is current as at the effective date of this Agreement and is indicative only:

RRPs are adjusted per country using the platform's published PPP model; every tier is available in every country.

20. Platform Fee and Payouts

• Platform Fee: 30% of the Partner's Gross Margin on each transaction, retained by Abilay in addition to the RRP.
• Founding cohort: the first fifty (50) transacting Partners receive the founding-cohort fee term of 20% of the Partner's Gross Margin on each transaction, retained by Abilay in addition to the RRP. This arrangement is locked in for the life of their agreement, only terminated in the event of Suspension and Termination, as outlined in Section 18.
• Payout timing: net margin is transferred to the Partner's Stripe Connect Account, typically within two (2) business days of successful payment;
• Minimum invoice: platform-enforced as the RRP plus the Platform Fee percentage on the applicable base - invoices below the minimum are rejected; and
• Fee changes: per Section 8 - thirty (30) days' notice, prospective only.

21. Ethical Pricing Reference

• Excessive Markup Threshold: a Client-Facing Price exceeding [5x] the applicable PPP-adjusted RRP for the tier, sustained at renewal, triggers the review process in Section 9.
• Review trigger - complaints: any credible Client complaint alleging conduct prohibited by Section 9;
• Review response window: ten (10) business days;
• Acceptable margin justifications: examples include onboarding and control implementation; document tailoring; evidence and staff-compliance administration; support SLAs; monitoring; bundled managed services with identifiable scope; and
• Unacceptable justifications: a Client's inability to price-compare; invented compliance urgency; misattributed third-party fees; concealment of the product purchased.

22. General

This Agreement is governed by the laws of Queensland, Australia, and the parties submit to the non-exclusive jurisdiction of its courts.

Notices may be given via the MSP Portal, to the email addresses on record, or by post to GPO Box 730, Brisbane, Queensland, Australia, 4001.

The Partner may not assign this Agreement without Abilay's written consent (not unreasonably withheld for a solvent acquirer of the Partner's business). Abilay may assign to a related body corporate or acquirer.

This Agreement and the Terms of Use are the entire agreement on their subject matter. If any provision is unenforceable, it is severed and the remainder continues. A failure to enforce a right is not a waiver of it.

23. Updates to This Agreement

This Agreement may be updated from time to time. Any changes will be published with a revised effective date. We encourage you to review this Statement periodically.