Version 1.0 · Effective September 15, 2026 · Published at www.fitzenterprises.com/master-services-agreement

This Master Services Agreement (the “MSA”) governs all services provided by Fitz Enterprises LLC, a Connecticut limited liability company with its principal place of business at 22 Railroad Street, New Milford, CT 06776 (“Fitz” or “Provider”), to any client that executes a Client Agreement or Service Order referencing this MSA (“Client”). By signing a Client Agreement or Service Order, Client agrees to be bound by the version of this MSA identified in that document. Fitz and Client are each a “Party” and together the “Parties.”

1. Definitions

“Client Agreement” means the document executed by Client and Fitz that identifies Client, the Services ordered, Covered Users, Covered Sites, fees, term, and any negotiated variations, and that incorporates this MSA by reference.

“Effective Date” means the effective date stated in the Client Agreement.

“Covered User” means a named individual employee, contractor, or agent of Client who is authorized to receive Services and is counted for per-user billing. Shared mailboxes, service accounts, and conference-room devices are not Covered Users unless the Client Agreement says otherwise.

“Covered Site” means each physical location listed in the Client Agreement at which Fitz provides Site Services, including any home office designated there.

“Managed Devices” means workstations, laptops, servers, and mobile devices assigned to Covered Users and enrolled in Fitz’s management tooling.

“Services” means, collectively, Managed IT Services, Site Services, Professional Services, and Advisory Services, each as described in Section 3 and the applicable Schedule, Client Agreement, or Service Order.

“Service Order” means a written order, proposal, quote, or statement of work executed (including electronically) by both Parties that references this MSA or a Client Agreement and describes specific Services, quantities, fees, and any special terms.

“Service Tier” means the Managed IT Services package selected by Client — Foundation, Secure, or Compliance Pro — as described in Schedule A.

“Onboarding” means the initial deployment, discovery, documentation, tooling installation, and configuration work required to bring Client onto a Service Tier, or to move Client between Service Tiers.

“Third-Party Products” means hardware, software, licenses, subscriptions, cloud services, and security subscriptions supplied by a manufacturer, publisher, or vendor other than Fitz, whether purchased through Fitz or directly by Client.

“Business Hours” means 8:00 AM – 5:00 PM Eastern Time, Monday through Friday, excluding U.S. federal holidays.

“Security Incident” means a confirmed event resulting in unauthorized access to, or acquisition, disclosure, encryption, or destruction of, Client data within systems under Fitz’s management, or a material disruption to the availability of such systems.

“Security Recommendation” means a product, service, configuration, or practice that Fitz has identified to Client in writing (including by ticket, email, or report) as necessary or advisable to maintain the security, backup, or compliance posture of Client’s environment.

“Confidential Information” has the meaning given in Section 10.

2. Structure, Precedence, and Versions

2.1 This MSA establishes the general terms governing all Services. Client-specific terms — parties, contacts, Covered Users, Covered Sites, pricing, term, and any negotiated variations — are set out in the Client Agreement. Additional Services are ordered through Service Orders. Each Client Agreement and Service Order is incorporated into and governed by this MSA.

2.2 The Schedules attached to this MSA form part of it: Schedule A (Service Tier Descriptions), Schedule B (Rates & Billing Rules), Schedule C (Service Levels), and Schedule D (Client Responsibilities & Acceptable Use).

2.3 Order of precedence. If there is a conflict, the following order controls: (a) a Business Associate Agreement or other regulatory addendum executed by the Parties; (b) the Client Agreement, but only where it expressly identifies the MSA provision it varies; (c) the body of this MSA; (d) the Schedules; (e) a Service Order.

2.4 Client’s purchase orders, vendor portals, or standard terms do not modify this MSA or any Client Agreement, even if Fitz acknowledges or performs against them.

2.5 Versions. Each version of this MSA is identified by a version number and effective date and is published at www.fitzenterprises.com/master-services-agreement, with prior versions available on request or archived at the same location. The version that governs a Client Agreement is the version identified in that Client Agreement. Fitz may publish a revised version at any time. A revised version applies (a) to any Client Agreement or Service Order executed after its effective date, (b) to existing Client Agreements on renewal, and (c) to existing Client Agreements during their current term thirty (30) days after Fitz gives Client written notice of the revision, unless Client objects in writing within that period, in which case the previously governing version continues to apply until the end of the then-current term. Fitz will not use a revision to increase fees stated in a Client Agreement except as permitted by Section 5.8.

3. Services

3.1 Managed IT Services. Fitz will provide the Service Tier selected in the Client Agreement, as described in Schedule A, to the number of Covered Users and Managed Devices stated there. Fitz will deliver the Services using the tools, vendors, and methods it selects in its professional judgment and may change them from time to time without reducing the overall level of service.

3.2 Site Services. For each Covered Site, Fitz will provide network, firewall, wireless, and on-site infrastructure management as described in Schedule A and priced in the Client Agreement. Site Services are billed per Covered Site in addition to per-user fees.

3.3 Professional Services. Projects, installations, cabling, migrations, hardware refreshes, web development, and other work outside the scope of a Service Tier are Professional Services and will be quoted in a Service Order, either at the hourly rates in Schedule B or as a fixed-fee bundle.

3.4 Advisory Services. Strategy, technology risk assessments, AI readiness and governance, compliance roadmapping, and fractional CIO engagements are Advisory Services and will be described and priced in a separate Service Order, typically on a fixed-fee or retainer basis.

3.5 Onboarding. Every Service Tier includes an Onboarding phase and an Onboarding fee as set out in the Client Agreement. Onboarding begins on the Client Agreement date and full Service Tier coverage begins on the Service Commencement Date stated in the Client Agreement (the “Commencement Date”). A change of Service Tier requires a new Onboarding fee for the additional deployment work involved.

3.6 Exclusions. Unless a Client Agreement or Service Order expressly includes them, the Services do not include: (a) Third-Party Products and their subscription costs, including firewall and network security subscriptions; (b) repair or replacement of hardware; (c) support for equipment, software, or users not listed in the Client Agreement; (d) on-site work outside Business Hours; (e) data recovery beyond the backup retention in the selected Service Tier; (f) software development or custom integrations; (g) remediation of a security incident that pre-dates the Commencement Date or results from Client’s breach of Schedule D; and (h) anything listed as “Not included” in Schedule A.

3.7 Regulated clients. The Foundation tier is not offered to clients that are subject to HIPAA/HITECH, GLBA and the FTC Safeguards Rule, SEC Regulation S-P, NYDFS Part 500, PCI DSS, or similar regulatory obligations. Such clients must select Secure or Compliance Pro. Where Client is a HIPAA covered entity or business associate, the Parties will execute Fitz’s Business Associate Agreement before the Commencement Date.

3.8 Remote workers. Covered Users who work primarily from a location that is not a Covered Site receive remote support only; any on-site visit to such a location is a Professional Service unless that location is added to the Client Agreement as a Covered Site.

3.9 Approvals. A Service Order, quote acceptance, change request, or other approval sent from an email address on Client’s domain, submitted through Fitz’s portal or ticketing system under a Client user’s account, or given by Client’s designated primary or secondary contact is deemed authorized by Client, and Fitz may rely on it without further verification.

4. Term and Termination

4.1 Term. The Client Agreement begins on its Effective Date and continues for the Initial Term stated in it, then renews automatically for successive renewal terms of the length stated in the Client Agreement (or, if none is stated, twelve (12) months) unless either Party gives written notice of non-renewal at least sixty (60) days before the end of the then-current term. Service Orders for recurring Services follow the same rule.

4.2 Termination for cause. Either Party may terminate the Client Agreement or an affected Service Order if the other Party materially breaches it and fails to cure within thirty (30) days after written notice describing the breach, except that Client’s cure period for a payment breach is ten (10) days. Fitz may suspend Services on ten (10) days’ notice if any undisputed invoice remains unpaid thirty (30) days after the invoice date, and may terminate if it remains unpaid thirty (30) days after suspension.

4.3 Early termination by Client. If Client terminates a Client Agreement or Service Order for convenience, or Fitz terminates for Client’s uncured breach, before the end of the then-current term, Client will pay, within 30 days, an early termination fee equal to seventy-five percent (75%) of the recurring fees remaining for the balance of the then-current term, plus any unpaid fees for Services performed and any unamortized Onboarding or Third-Party Product costs, unless the Client Agreement states a different amount.

4.4 Termination by Fitz for convenience. Fitz may terminate any Client Agreement or Service Order on ninety (90) days’ written notice. No early termination fee applies.

4.5 Transition assistance. On termination or non-renewal, and provided all undisputed fees are paid, Fitz will (a) provide Client with administrative credentials and documentation for systems Client owns, (b) release Client’s data in a standard export format, and (c) on request, provide up to ten (10) hours of transition assistance at the hourly rates in Schedule B. Fitz’s management agents, licenses, and subscriptions will be removed or transferred within thirty (30) days after the termination date, after which Fitz has no further obligation to retain Client data.

4.6 Survival. Sections 5, 9.8 through 9.10, 10, 11, 12, 13, 14, 16, 17, and 18 survive termination.

5. Fees and Payment

5.1 Fees. Client will pay the fees stated in the Client Agreement and each Service Order, subject to the rates and billing rules in Schedule B. Recurring fees are billed monthly in advance; Onboarding fees and fixed-fee projects are billed as stated in the Client Agreement or Service Order; hourly work and Third-Party Products are billed monthly in arrears or on order, respectively.

5.2 Per-user model. Managed IT Services are priced per Covered User, not per device. The seat count in the Client Agreement is a minimum monthly commitment. Client may add Covered Users at any time; additions are billed pro rata from the date added. Client may reduce Covered Users on thirty (30) days’ notice, but not below the seat count stated in the Client Agreement during the Initial Term.

5.3 Seat true-up. Fitz will review the active user count quarterly against Client’s directory and management tooling and invoice for any Covered Users in excess of the contracted count.

5.4 Site Services and security subscriptions. Site Service fees are billed per Covered Site as stated in the Client Agreement and do not include firewall, gateway security, or network security subscriptions, which are Third-Party Products billed separately for the vendor deployed and the term Client selects (annual or multi-year).

5.5 Third-Party Products. Hardware and licenses purchased through Fitz are billed on order and are non-cancellable and non-refundable once ordered. Title passes on payment in full; risk of loss passes on delivery. Manufacturer warranties pass through to Client; Fitz makes no separate warranty on Third-Party Products. Extended warranties, where quoted, are itemized in the Service Order. Client will inspect delivered products and notify Fitz within seven (7) days of any damage, defect, or incorrect item; Fitz will assist with a manufacturer return or exchange where the manufacturer permits it, and any restocking fee or return shipping is Client’s responsibility.

5.6 Payment terms. Invoices are due upon receipt, payable by ACH or credit card on file unless the Client Agreement states otherwise. Fitz may require automatic payment for recurring fees. Amounts not paid within fifteen (15) days after the invoice date are past due and accrue interest at 1.5% per month or the maximum lawful rate, whichever is lower, and Client will reimburse reasonable collection costs. Card payments may carry a surcharge of up to three percent (3%) where permitted by law.

5.7 Disputes. Client must notify Fitz in writing of any disputed invoice item within fifteen (15) days of the invoice date, with reasonable detail, and must pay the undisputed portion on time. The Parties will work in good faith to resolve disputes within 30 days.

5.8 Annual adjustment. Fitz may increase recurring fees once per contract year, effective on the anniversary of the Commencement Date, on thirty (30) days’ written notice, by up to the greater of five percent (5%) or the change in CPI-U over the prior twelve months. Increases in Third-Party Product costs may be passed through at any time on notice.

5.9 Taxes. Fees exclude sales, use, and similar taxes, which Client will pay unless it provides a valid exemption certificate.

5.10 Travel. On-site work at Covered Sites within thirty (30) miles of New Milford, CT is included in Site Services. Travel beyond that radius, and any on-site visit outside a Covered Site, is billed at the trip rate in Schedule B plus mileage at the current IRS rate.

5.11 Acceleration. If Fitz terminates for Client’s uncured payment breach, all fees for the balance of the then-current term that would be payable under Section 4.3, together with any other unpaid amounts, become immediately due.

6. Client Responsibilities

6.1 Client will (a) designate a primary contact authorized to make decisions and approve changes; (b) provide timely access to premises, systems, credentials, and personnel; (c) maintain supported, licensed, and vendor-supported hardware and software; (d) comply with Schedule D; (e) promptly report incidents, suspected security events, and personnel changes affecting Covered Users; and (f) implement Fitz’s reasonable security recommendations or acknowledge in writing that it has declined them.

6.2 Security Recommendations. Fitz will document material Security Recommendations in writing. Client may accept or decline any Security Recommendation, and Fitz will record Client’s decision. Where a Security Incident or other loss arises from, or is materially worsened by, a risk that a declined or materially delayed Security Recommendation was designed to address: (a) Fitz has no liability for that Security Incident or loss; (b) Client will indemnify Fitz against third-party claims arising from it; (c) response, remediation, and recovery labor is not covered by any Service Tier and is billed at the applicable hourly rates in Schedule B; and (d) Client’s cyber-insurance obligations remain Client’s alone.

6.3 Client warrants that it owns or has the right to permit Fitz to access all systems, data, and software on which Fitz works.

6.4 Security testing. Client authorizes Fitz to send simulated phishing messages and conduct similar security awareness testing of Client’s users without advance notice to the users, as part of the Secure and Compliance Pro tiers.

7. Service Levels

7.1 Fitz will use commercially reasonable efforts to meet the response targets in Schedule C. Response targets are goals, not guarantees, and the remedies in Schedule C are Client’s sole remedy for a missed target.

7.2 Service Level targets do not apply to (a) the Foundation tier except as expressly stated, (b) issues caused by Third-Party Products, Client’s networks or ISPs, or Client’s breach of this MSA, (c) scheduled maintenance, or (d) events beyond Fitz’s reasonable control.

8. Third-Party Products and Licensing

8.1 Third-Party Products are subject to their manufacturers’ or publishers’ terms, which Client accepts by use. Fitz’s management, security, backup, and monitoring tooling remains the property of Fitz or its vendors and is licensed to Client only for the term of the applicable Client Agreement.

8.2 Fitz may act as Client’s agent to procure, renew, and administer Third-Party Products. Client authorizes Fitz to accept vendor terms on Client’s behalf for products listed in a Client Agreement or Service Order.

8.3 Microsoft 365, Google Workspace, and similar cloud subscriptions are billed per license as Third-Party Products and are not part of the per-user Service Tier fee unless the Client Agreement states otherwise.

9. Security, Data, and Compliance

9.1 Fitz will maintain administrative, technical, and physical safeguards appropriate to the Services and consistent with the security program described in Fitz’s then-current security documentation. Fitz is pursuing SOC 2 alignment; no representation is made that a SOC 2 report has been issued unless stated in writing.

9.2 Backup and retention. Backup scope and retention period are determined by the selected Service Tier as set out in Schedule A. Fitz will perform periodic restore tests as described in Schedule A. Fitz does not guarantee recovery of data that was not within the backup scope or that Client excluded.

9.3 Compliance program; no compliance-officer role. The Compliance Pro tier includes the compliance program activities described in Schedule A for the framework(s) identified in the Client Agreement. Client remains solely responsible for (a) determining which laws, regulations, and standards apply to its business; (b) deciding whether, when, and how to make any notification, filing, or report to a regulator, examiner, insurer, customer, or affected individual, including whether an event is “material,” “reportable,” or otherwise triggers an obligation; and (c) maintaining the policies and controls that its obligations require in areas Fitz does not manage. Fitz does not provide legal, regulatory, accounting, or tax advice; nothing Fitz produces (including risk analyses, policies, incident summaries, or participation in examiner or auditor meetings) is a legal opinion or regulatory determination, and Fitz does not act as Client’s compliance officer, security officer, privacy officer, or “qualified individual” unless a Service Order expressly says so. Cooperation with regulators, examiners, auditors, or insurers beyond the activities included in the Service Tier is a Professional Service.

9.4 Business Associate Agreement. Where Client is a covered entity or business associate under HIPAA, the Parties’ Business Associate Agreement governs Fitz’s handling of protected health information and controls over this MSA to the extent of any conflict.

9.5 Incident response. Fitz will notify Client without undue delay, and in any event within seventy-two (72) hours, after confirming a Security Incident, and will contain, investigate, and remediate it in accordance with its incident response procedures. Each Service Tier includes the number of hours of incident response, recovery, and remediation labor stated in Schedule A per contract year; unused hours do not carry over, and labor beyond that allowance is billed at the emergency rate in Schedule B. Hardware, licenses, forensic firms, and other third-party costs required by an incident are Client’s responsibility. Client will follow Fitz’s incident instructions and provide prompt access and information; failure to do so is a material breach. This Section does not apply to incidents caused by Fitz’s own breach of this MSA, which are governed by Sections 12 through 14.

9.6 Data ownership. Client owns its data. Fitz may collect and use system telemetry, logs, and de-identified operational metrics to deliver and improve the Services.

9.7 Cyber insurance. Client will maintain cyber-liability insurance as required by Section 15.2. Fitz will provide reasonable assistance with insurer questionnaires at the hourly rates in Schedule B where the work exceeds two (2) hours per year.

9.8 Vulnerability during implementation. The protections of a Service Tier are not fully in place until Onboarding is complete, and the same applies to any later deployment of new hardware, software, or security controls. Fitz is not liable for any Security Incident or loss that occurs during Onboarding or during the procurement, installation, or deployment of additional controls, except to the extent caused by Fitz’s gross negligence or willful misconduct.

9.9 Ransomware, extortion, and sanctions. Nothing in this MSA requires Fitz to communicate or negotiate with a threat actor, or to make, arrange, or facilitate any ransom or extortion payment. Any decision to communicate with a threat actor or make a payment is Client’s alone, made with Client’s own counsel and insurer, and Fitz will not facilitate a payment that in Fitz’s judgment or on advice of counsel may violate sanctions, anti-money-laundering, or similar law; such refusal is not a breach. Fitz’s assistance in a ransomware or extortion event is limited to technical response and recovery under Section 9.5.

9.10 Regulatory reporting. Fitz will provide, on request, factual information within its knowledge and control about a Security Incident (timeline, systems affected, categories of data, and corrective actions) to help Client evaluate its notification obligations. Client is solely responsible for determining whether any notification or report is required under HIPAA, GLBA, SEC rules, NYDFS Part 500, state breach laws, card-brand rules, an insurance policy, or any other obligation, and for its content, timing, and filing. Fitz will not be deemed to assume obligations specific to a regulated entity unless a Service Order or regulatory addendum expressly says so.

10. Confidentiality

10.1 “Confidential Information” means non-public business, technical, financial, client, and personal information disclosed by one Party to the other, including Client Agreement pricing, Client’s data and credentials, and Fitz’s methods, documentation, and tooling configurations.

10.2 Each Party will use the other’s Confidential Information only to perform or receive the Services, protect it with at least reasonable care, and disclose it only to personnel and contractors who need it and are bound by comparable obligations. Confidential Information excludes information that is public through no fault of the recipient, already known to the recipient, independently developed, or lawfully received from a third party. Disclosure required by law is permitted with prompt notice where lawful.

10.3 These obligations continue for three (3) years after termination, and indefinitely for trade secrets, credentials, and regulated personal information.

11. Intellectual Property

11.1 Fitz retains all rights in its pre-existing materials, tools, scripts, templates, documentation formats, configurations, methodologies, and know-how, and in any improvements to them (“Fitz IP”). Fitz grants Client a non-exclusive license to use Fitz IP embedded in deliverables for Client’s internal business purposes during and after the term.

11.2 Subject to payment in full, deliverables created specifically for Client under a Service Order — including website code, content, and design created for Client — are owned by Client, excluding Fitz IP and open-source or Third-Party components, which are licensed under their own terms.

11.3 Client-owned accounts. Domain names, hosting accounts, cloud tenants, and software licenses procured for Client will be registered in Client’s name where the vendor permits, with Fitz as administrator. Fitz will not withhold access to Client-owned accounts except while an undisputed invoice for those accounts is past due.

11.4 Fitz may identify Client as a client and describe the general nature of the engagement in marketing materials unless Client opts out in writing. Case studies quoting Client require Client’s prior written approval.

12. Warranties and Disclaimers

12.1 Fitz warrants that the Services will be performed in a professional and workmanlike manner consistent with generally accepted industry standards. Client’s exclusive remedy for breach of this warranty is re-performance of the non-conforming Services, or, if Fitz cannot re-perform, a refund of the fees paid for those Services.

12.2 EXCEPT AS EXPRESSLY STATED IN THIS MSA, FITZ DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. FITZ DOES NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE, THAT ALL SECURITY THREATS WILL BE PREVENTED OR DETECTED, OR THAT ANY THIRD-PARTY PRODUCT WILL PERFORM AS DESCRIBED BY ITS VENDOR. No security program eliminates risk; Client acknowledges that the Services reduce but do not eliminate the risk of cyber incidents and data loss.

13. Limitation of Liability

13.1 TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOSS OF DATA, OR BUSINESS INTERRUPTION, ARISING OUT OF OR RELATED TO THIS MSA OR ANY CLIENT AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

13.2 TO THE MAXIMUM EXTENT PERMITTED BY LAW, FITZ’S TOTAL CUMULATIVE LIABILITY ARISING OUT OF OR RELATED TO THIS MSA AND ANY CLIENT AGREEMENT, UNDER ALL CLAIMS AND THEORIES COMBINED, WILL NOT EXCEED THE FEES PAID BY CLIENT TO FITZ FOR THE SERVICES GIVING RISE TO THE CLAIM DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM (THE “BASIC CAP”). Amounts paid for Third-Party Products are excluded from this calculation.

13.3 Security Incident cap. Fitz’s total liability for all claims arising from Security Incidents, including indemnity under Section 14.1, will not exceed the lesser of (a) one and one-half (1.5) times the Basic Cap or (b) the insurance proceeds actually paid under Fitz’s technology errors & omissions and cyber-liability policies in respect of those claims (the “Security Incident Cap”). Amounts paid under the Security Incident Cap count toward, and are not in addition to, the Basic Cap.

13.4 The Basic Cap and the Security Incident Cap are aggregate limits on all claims and losses over the life of the Client Agreement and all Service Orders; they are not per-claim, per-year, or per-lawsuit limits and do not reset on renewal. Service credits, refunds, and indemnity payments count against them.

13.5 The exclusions and caps in this Section do not apply to a Party’s gross negligence or willful misconduct, death or personal injury caused by a Party, breach of Section 10, Client’s payment obligations, or Client’s indemnification obligations under Sections 6.2 and 14.2.

14. Indemnification

14.1 By Fitz. Fitz will defend and indemnify Client against third-party claims that the Services, as delivered by Fitz and used as permitted, infringe a U.S. patent, copyright, or trademark, excluding claims arising from Third-Party Products, Client materials, or modifications not made by Fitz.

14.2 By Client. Client will defend and indemnify Fitz against third-party claims arising from (a) Client’s data, content, or materials; (b) Client’s breach of Schedule D or applicable law; (c) Client’s declined security recommendations under Section 6.2; or (d) Client’s use of the Services other than as permitted.

14.3 The indemnified Party will give prompt notice, allow the indemnifying Party to control the defense and settlement (provided no settlement admits fault or imposes obligations on the indemnified Party without its consent), and cooperate reasonably at the indemnifying Party’s expense.

15. Insurance

15.1 During the term, Fitz will maintain commercial general liability insurance of at least $1,000,000 per occurrence and technology errors & omissions / cyber liability insurance of at least $1,000,000 per claim, and will provide certificates on request. Client will maintain property insurance covering its own equipment and cyber-liability coverage appropriate to its business.

15.2 Client insurance. As a condition of the Client Agreement, Client will maintain first-party cyber insurance from a reputable carrier in commercially reasonable amounts covering data breach response, business interruption, cyber extortion, data restoration, and related fines and penalties, and will provide proof on request. Client waives, and will cause its insurers to waive, all rights of recovery and subrogation against Fitz for any loss to the extent covered by insurance Client carries or was required to carry under this Section; deductibles and self-insured retentions are treated as insurance for this purpose. Failure to maintain the required coverage for more than thirty (30) days is a material breach.

16. Artificial Intelligence and Automated Tools

16.1 Use of AI Tools. Fitz may use artificial intelligence, machine learning, and other automated tools (“AI Tools”) in delivering the Services, including for threat and anomaly detection, ticket classification and routing, email and web filtering, assisted responses to routine support requests, documentation, and internal quality and efficiency, and in Advisory Services where a Service Order describes the use.

16.2 No training on Client data. Fitz will not use Client data to train or improve any general-purpose AI model made available to other customers or the public, and will not permit a vendor to do so, unless Client expressly agrees in a Service Order. Fitz may use Client data to operate, secure, and support the Services, to configure AI Tools within Client’s own environment, and to produce de-identified, aggregated information that does not identify Client or any individual.

16.3 Transparency. On reasonable request, Fitz will describe the categories of AI Tools used to deliver Client’s Services, the kinds of decisions or recommendations they support, and the types of Client data they process. Fitz is not required to disclose model architectures, detection logic, or vendor trade secrets. Client may ask in writing that specific AI-powered features be disabled or limited; Fitz will accommodate the request where feasible, Client accepts any resulting reduction in functionality or efficiency, and alternative configurations are a Professional Service.

16.4 Human review and decision ownership. AI Tools assist with detection, triage, prioritization, drafting, and recommendations; they do not replace Client’s judgment. Client retains sole responsibility for interpreting any alert, score, output, or recommendation and for deciding whether and how to act on it. Client will not rely solely on an output of the Services or of any AI Tool as the basis for a decision about employment, credit or lending, insurance, housing, healthcare, or eligibility for essential services, or for any decision that applicable law requires to include human review, and Client will maintain its own policies and oversight for such decisions. Where AI Tools take automated technical actions in Client’s environment (for example, quarantining a message or isolating an endpoint), those actions are limited to security and operational controls, and Client may request human-review checkpoints where technically feasible.

16.5 Advisory deliverables. AI-assisted analyses, drafts, assessments, and recommendations delivered under Advisory Services are reviewed by Fitz before delivery but remain professional advice for Client’s evaluation; they are not warranties of outcome, and Client is responsible for its business decisions made in reliance on them.

16.6 Allocation of risk. Fitz’s liability for AI-related claims is limited to Fitz’s misuse of Client data in breach of Section 16.2 or Fitz’s knowing deployment of an AI Tool in violation of applicable law, in each case subject to Section 13. Fitz is not liable for claims arising from Client’s use of AI outputs contrary to this Section or Fitz’s written guidance, from Client’s failure to maintain human review or safeguards appropriate to its industry, or from AI-powered products Client adopts other than through Fitz.

17. Non-Solicitation

17.1 During the term and for twelve (12) months afterward, Client will not directly or indirectly solicit for employment or engagement any employee or contractor of Fitz who performed Services for Client, without Fitz’s written consent. If Client breaches this Section, Client will pay Fitz a placement fee equal to one hundred percent (100%) of the individual’s first-year compensation as liquidated damages, which the Parties agree is a reasonable estimate of Fitz’s loss.

17.2 Injunctive relief. A breach or threatened breach of Section 10 or this Section 17 would cause irreparable harm for which damages are an inadequate remedy, and the injured Party may seek injunctive relief without posting bond, in addition to any other remedy.

18. General

18.1 Governing law and venue. This MSA and each Client Agreement are governed by the laws of the State of Connecticut, without regard to its conflict-of-laws rules. The Parties consent to the exclusive jurisdiction of the state and federal courts located in Litchfield County, Connecticut, and waive any objection to venue there. In any action to enforce this MSA or a Client Agreement, the prevailing Party may recover its reasonable attorneys’ fees and costs.

18.2 Dispute resolution. Before commencing litigation (other than for injunctive relief or collection of undisputed fees), the Parties will attempt in good faith to resolve any dispute through discussion between their principals for at least thirty (30) days after written notice of the dispute.

18.3 Notices. Notices must be in writing and delivered by hand, nationally recognized courier, certified mail, or email with confirmation of receipt, to Fitz at 22 Railroad Street, New Milford, CT 06776 / MFitzpatrick@FitzEnterprises.com, and to Client at the address in the Client Agreement. Routine operational communications may be sent through Fitz’s ticketing system.

18.4 Independent contractor. Fitz is an independent contractor. Nothing in this MSA creates a partnership, joint venture, agency (except as stated in Section 8.2), or employment relationship.

18.5 Subcontractors. Fitz may use qualified subcontractors and vendors to perform portions of the Services and remains responsible for their performance.

18.6 Force majeure. Neither Party is liable for delay or failure caused by events beyond its reasonable control, including natural disasters, utility or ISP failures, vendor outages, pandemics, labor disputes, or governmental action, provided it uses reasonable efforts to resume performance. Payment obligations are not excused. If a force majeure event prevents performance for more than thirty (30) consecutive days, either Party may terminate the affected Service Order on ten (10) days’ notice without an early termination fee.

18.7 Assignment. Neither Party may assign a Client Agreement without the other’s written consent, except that Fitz may assign it to a successor in a merger, acquisition, or sale of substantially all of its assets on notice to Client.

18.8 Entire agreement; amendment; waiver. This MSA (in the version identified in the Client Agreement), its Schedules, the Client Agreement, and Service Orders are the entire agreement on their subject matter and supersede all prior proposals and understandings. Except as provided in Section 2.5, amendments must be in writing and signed by both Parties; a Service Order signed by both Parties is a sufficient writing. Failure to enforce a provision is not a waiver.

18.9 Severability. If a provision is held unenforceable, it will be modified to the minimum extent necessary and the remainder will continue in effect.

18.10 Counterparts; electronic acceptance. Client Agreements and Service Orders may be signed in counterparts and electronically, each of which is an original. Electronic acceptance of a Client Agreement that references this MSA constitutes acceptance of this MSA.

Schedule A — Service Tier Descriptions

This Schedule describes what is included in each Managed IT Service Tier and in Site Services. Where a row says “Not included,” the item is available as a Professional Service or add-on at the rates in Schedule B or as quoted.

A.1 Managed IT Service Tiers (per Covered User)

Fair use. “Unlimited” support means support reasonably required for the normal operation of Client’s business. Fitz may treat sustained usage materially above the average for clients of similar size, or requests driven by Client’s failure to follow Schedule D, as Professional Services after written notice.

A.2 Site Services (per Covered Site)

Site Services cover the shared infrastructure at a Covered Site and are billed per site regardless of user count.

A.3 Onboarding (all tiers)

Onboarding includes: discovery and documentation of the environment; deployment of Fitz’s management, security, and backup agents; MFA and baseline security configuration; user and device inventory; documentation of credentials and vendors; and a kickoff review. Remediation of pre-existing problems discovered during Onboarding (unsupported operating systems, missing licenses, failed hardware, absent backups) is quoted separately as a Professional Service or Third-Party Product before work begins.

Schedule B — Rates & Billing Rules

Per-user Service Tier fees, per-site fees, Onboarding fees, and minimum seat commitments are stated in each Client Agreement. The rates and rules below apply to all clients unless a Client Agreement expressly varies them.

B.1 Hourly & Project Rates

B.2 Third-Party Products & Subscriptions

Hardware, software, cloud licenses, and security subscriptions are quoted in the applicable Client Agreement or Service Order at Fitz’s then-current resale price. Firewall and network security subscriptions are quoted per vendor and term; Client may elect an annual or 3-year term where offered. Extended hardware warranties of 4–5 years are recommended and quoted where available. Prices for Third-Party Products are valid for 15 days from the quote date.

B.3 Term-Based Rate Classes

Per-user Service Tier fees and Site Service fees are quoted at Fitz’s standard rate, which assumes a 36-month Initial Term. Shorter commitments carry a flexibility premium because Fitz’s Onboarding investment and reserved capacity are recovered over a shorter period. The rate class is selected in the Client Agreement and applies to all recurring Managed IT and Site Service fees; Third-Party Products are not affected.

Tier availability by term: Compliance Pro is offered on 36-month or 12-month terms only. Foundation is offered on 12-month or month-to-month terms only. Renewal: on completion of a 36-month Initial Term, renewal terms are twelve (12) months at the 36-month rate class. If Client selects a different term length at renewal, the rate class changes to match the term selected.

B.4 Billing Presentation

Recurring fees are presented on the invoice as a bundled line per Service Tier and per Covered Site (for example, “Secure Managed IT — 8 users” and “Site Services — Main office”), with Third-Party subscriptions itemized separately. Detailed component pricing is available on request but is not itemized on the invoice.

Schedule C — Service Levels

Response targets below apply to the Secure and Compliance Pro tiers during Business Hours. “Response” means a qualified technician has acknowledged the ticket and begun work; it is not a resolution time. The Foundation tier receives best-effort response with no targets.

C.1 Requesting support. Client submits requests through Fitz’s ticket portal, the support email address provided at Onboarding, or by phone at 860-390-3489. P1 issues must be reported by phone to start the P1 clock. Requests sent by text message or personal channels are not tracked and do not start any target.

C.2 After-hours. Support outside Business Hours is available for P1 issues by calling the emergency line and is billed at the after-hours rate in Schedule B unless the Client Agreement includes an after-hours coverage add-on.

C.3 Scheduled maintenance. Fitz performs routine maintenance during a standing window of Sunday 12:00–6:00 AM ET, or after 7:00 PM ET on weekdays, and will give at least two (2) business days’ notice of maintenance likely to cause user-visible downtime.

C.4 Service credits. If Fitz misses the P1 or P2 response target more than two times in a calendar month, and Client reports the misses in writing within ten (10) days after month-end, Client will receive a credit of five percent (5%) of that month’s Managed IT fee, capped at fifteen percent (15%) per month. Credits are Client’s sole remedy for missed targets and are applied to a future invoice.

C.5 Exclusions. Targets do not apply during Onboarding, to issues excluded under Section 7.2, or where Client’s primary contact is unavailable to authorize work.

Schedule D — Client Responsibilities & Acceptable Use

Client will, and will ensure its Covered Users:

• Use only business-owned or Fitz-approved devices to access Client systems; personal devices require Fitz’s written approval and enrollment in management tooling.
• Keep MFA enabled on all accounts where Fitz has deployed it and never share credentials or MFA codes.
• Not disable, uninstall, or bypass Fitz’s security, backup, or monitoring agents.
• Not install unapproved software, browser extensions, or remote-access tools; requests go through the help desk.
• Report lost or stolen devices, suspected phishing, and unusual account activity immediately by phone.
• Notify Fitz of new hires at least three (3) business days before start and of departures on or before the last working day, so accounts can be provisioned or disabled on time.
• Maintain physical security of network equipment and servers at Covered Sites, including locked closets and controlled access.
• Maintain current licenses for all software Client uses and provide proof on request.
• Use the Services only for lawful business purposes and in compliance with applicable law and the terms of Third-Party Products.
• Complete assigned security awareness training within thirty (30) days of assignment (Secure and Compliance Pro tiers).

Fitz may suspend a user account or device that presents an active security risk and will notify Client’s primary contact promptly. Repeated violations of this Schedule that generate support work may be billed as Professional Services after written notice.

— End of Master Services Agreement v1.0 —