Customer Agreement & Terms of Service

NIST Assist LLC | Effective September 8, 2026. This page contains the Customer Agreement, Microsoft Subscription Schedule, Support Policy, Data Processing Addendum, and Privacy Notice. Contact support@nistassist.com or (940) 222-5311 for service and billing questions; contact privacy@nistassist.com for privacy requests.

1. Scope, orders, and acceptance

This Agreement governs business services supplied by NIST Assist LLC (NIST Assist, we, us) to Customer, including technology management, cybersecurity, compliance consulting, assessments, support, and resold subscriptions. An authorized representative accepts this Agreement by signing an order or statement of work that references it, or by expressly accepting it electronically. Existing signed agreements remain in effect according to their terms. Each order identifies the services or product, quantities, price, commitment period, billing frequency, renewal date, and included support. Customer must designate authorized contacts and approve purchases, seat increases, upgrades, and renewals through a documented order or instruction. Administrative access alone is not authorization to purchase.

Applicable Microsoft and other vendor terms govern their products and licensing rights. For NIST Assist services, a signed Master Services Agreement (MSA), statement of work (SOW), or order controls an expressly identified conflict with these general terms. The Data Processing Addendum controls our processing of Customer personal data unless a signed data-processing agreement provides otherwise. No NIST Assist document overrides mandatory law or applicable vendor licensing requirements.

2. Distributor and vendor arrangements

NIST Assist obtains products through distributors including Pax8 and TD SYNNEX. Customer must comply with the vendor license terms and applicable end-customer or product-specific distributor terms identified in the order or made available through provider websites, portals, links, or documentation before, during, and after activation or use, as updated from time to time under the applicable provider agreement. These include applicable use restrictions, eligibility rules, commitment periods, cancellation limits, renewal conditions, and charges for authorized orders. We will identify the applicable distributor and supply relevant terms upon request. Our private partner obligations are not imposed wholesale on Customer merely because we use that distributor. NIST Assist remains responsible for its own services and obligations to Customer.

By activating, accessing, or using licenses or subscriptions supplied by NIST Assist, Customer acknowledges and agrees to be bound by the applicable Microsoft terms and the applicable Pax8 and/or TD SYNNEX end-customer, product-specific, and pass-through terms for those licenses, as identified and made available to Customer before, during, and after activation or use through the reference links below, provider websites or portals, order documentation, or upon request. These terms are incorporated by reference into this Agreement to the extent applicable to Customer and the products ordered. Only the terms of the vendor and distributor involved in supplying the relevant product apply. Providers and distributors may update their terms and conditions from time to time. By using or continuing to use services, licenses, or subscriptions supplied by NIST Assist, Customer agrees to the most current provider and distributor terms applicable to those products and services, including updates when they become effective under the governing provider agreement and applicable law. Customer is responsible for reviewing the applicable terms before initial use and periodically during use, and for ensuring its authorized users comply. Required notices, effective dates, consent procedures, and any term-specific protections remain applicable. Availability after use does not by itself impose terms retroactively. If Customer does not agree, it must not activate or use the affected licenses and must contact NIST Assist immediately; declining or stopping use does not cancel an already authorized commitment or create a refund right beyond the applicable cancellation rules. Acceptance by use does not replace any separate acceptance, signature, click-through, or confirmation required by Microsoft or the applicable distributor, including the Microsoft Customer Agreement acceptance required before ordering.

Customer authorizes necessary sharing of account, contact, tenant, licensing, billing, and support information with the applicable vendor or distributor for provisioning, administration, support, and contractual compliance, subject to the Privacy Notice and applicable data-processing terms. Vendor availability, licensing changes, and permitted transfers may affect delivery. NIST Assist does not author or control provider or distributor terms and is not responsible for changes made independently by those parties. To the maximum extent permitted by law, NIST Assist is not liable for losses arising solely from those changes, including changes to product availability, functionality, licensing, pricing, or renewal and cancellation rules. This does not excuse NIST Assist’s own contractual obligations, required notices, or acts or omissions, and does not exclude liability that cannot lawfully be excluded. We cannot promise exceptions, refunds, or credits a vendor or distributor has not approved. Customer-approved noncancelable commitments remain payable subject to applicable law and permitted credits.

3. Payment, advance billing, and late fees

Invoices are due upon receipt. Accounts are billed in advance for the upcoming service or subscription period. Monthly-term subscriptions are billed in advance for each monthly term; annual subscriptions are billed in full in advance for the entire annual term. Usage charges, additional licenses, prorated adjustments, and charges that cannot be determined in advance are billed when determined and are due upon receipt. Invoices are delivered to Customer's designated billing email or agreed portal; Customer must keep those details current. Applicable taxes are additional unless the order states otherwise or a valid exemption applies.

If an invoice remains unpaid for more than thirty (30) calendar days after its due date, a one-time late fee of five percent (5%) of the unpaid invoice balance will be assessed, or the maximum lawful amount, whichever is less. Payments and credits reduce the balance used to calculate the fee. Previously assessed late fees are excluded; the fee is not compounded or reassessed monthly on the same overdue amount. Any unlawful excess will be reduced, credited, or refunded as required by law. The 30-day threshold does not extend the due date or create a right to service or renewal without required prepayment.

Report billing errors promptly to support@nistassist.com with the invoice number and disputed amount. We will investigate and correct confirmed errors; undisputed amounts remain due. A billing dispute does not itself cancel vendor commitments. Advance billing and late fees are NIST Assist commercial policies, not Microsoft-mandated customer payment terms.

4. Customer responsibilities and delegated access

Customer must provide accurate information, legally licensed products, authorized contacts, timely cooperation, and lawful instructions; protect credentials; and promptly report suspected incidents. Customer retains ownership and control of its data and tenant. Required reseller relationships and administrative access are separate. Customer must expressly approve the least-privileged, time-bound GDAP or other access reasonably necessary for the contracted services. We will use approved access only for authorized service delivery and security purposes. Revocation or expiration may limit affected services; it does not cancel licensing commitments.

The SOW should allocate backups, retention, monitoring, patching, incident response, and recovery responsibilities. Microsoft retention or availability features are not a substitute for an agreed backup plan. Customer must not use services for unlawful activity, infringement, malware, unauthorized testing, fraud, or unsolicited bulk communications. Security and compliance services do not guarantee certification, audit success, or freedom from threats; each party remains responsible for its own contractual and legal duties.

5. Confidentiality, suspension, and offboarding

Each party will protect the other's nonpublic business and technical information with reasonable care, use it only for the engagement, and disclose it only to authorized personnel or service providers with appropriate confidentiality duties, or as required by law. This excludes information lawfully public, independently developed, previously known without restriction, or lawfully received from another source.

We may suspend affected services for nonpayment, material breach, abuse, security risk, or vendor or legal requirements. We will provide notice and a reasonable opportunity to resolve the issue when practicable; urgent containment may require immediate action. Suspension does not necessarily stop vendor charges. Termination and notice periods in a signed agreement control. Where none is specified, either party may terminate NIST Assist services on 30 days' written notice, without ending an outstanding vendor commitment. Accrued payment, confidentiality, data protection, and surviving obligations remain in effect.

On exit, we will reasonably cooperate with an authorized transfer, removal of our administrative access, and return or export of Customer data within our control. Transition work outside the contracted scope requires an agreed charge. Vendor transfer eligibility, service cutoff, and retention rules apply; arrange exports before expiration. We do not promise a universal recovery or data-retention period after a vendor subscription ends.

6. Liability, governing law, and changes

To the maximum extent permitted by law, NIST Assist is not liable for indirect, incidental, consequential, punitive, special, or exemplary damages, including lost profits, lost revenue, business interruption, loss of data, reputational harm, or regulatory penalties. Our aggregate liability for an applicable service is limited to the amount Customer paid us for that service during the preceding twelve months. These limits do not exclude liability that cannot lawfully be excluded or override a signed agreement that expressly provides different limits. Vendor warranties and service levels apply to vendor products; NIST Assist does not enlarge them.

Texas law governs this Agreement, subject to mandatory applicable law. Updates to NIST Assist’s own policies will show an effective date. Provider and distributor terms and independent changes are governed by Section 2 and, for Microsoft products, Section 7. Material changes affecting fees, commitments, support, or privacy will be communicated to the designated contact before they apply as required by the governing agreement and law. Posting alone does not retroactively amend a signed agreement or create a new paid commitment. Copies of the applicable policy version may be requested from support@nistassist.com.

Microsoft Subscription Schedule

7. Microsoft acceptance and product terms

Before an order is placed, an authorized customer representative must accept the applicable Microsoft Customer Agreement (MCA). Acceptance of NIST Assist's terms does not substitute for Microsoft acceptance. We coordinate required acceptance confirmation with the applicable distributor or Microsoft's direct acceptance process and retain available acceptance and order records. Microsoft Product Terms, applicable data-protection terms, service-level agreements, and product-specific restrictions apply to the purchased products. Microsoft terms are available before, during, and after activation or use through the reference links below, Microsoft’s websites or portals, or upon request. Customer’s use and continued use are subject to the most current Microsoft terms applicable to the purchased products, as updated and effective under the MCA, the applicable order, and law, consistent with Section 2. Updates apply according to Microsoft’s governing change provisions, including any required notice or acceptance and protections for an existing subscription term; publication alone does not make every update retroactive.

8. Annual prepayment and renewals

No new or renewed annual subscription is allowed unless NIST Assist receives payment in full for the annual term on or before its start date. We do not offer monthly or installment payments for annual terms. Any annual discount requires full annual prepayment. Existing annual commitments previously billed monthly remain payable under their governing arrangements through the end of their committed term.

At renewal, an annual subscription will change to an available standard monthly-term subscription at the disclosed then-current monthly price unless the next annual term is paid in full on or before renewal. Conversion occurs at term end, subject to vendor eligibility, and does not shorten an existing commitment. We will communicate renewal options, pricing, and any processing deadline before renewal. Customer must provide instructions in time for vendor processing. If a monthly term is unavailable, we will not renew annually without full prepayment and will notify Customer of available alternatives or expiration.

A Microsoft Extended Service Term (EST) is a separate paid extension, not a standard monthly renewal or free grace period. Where offered, EST requires a disclosed price and documented Customer authorization; we will not intentionally select a paid EST without that authorization. Microsoft applies additional EST charges under its applicable rules. If no eligible, authorized continuation is arranged, services may stop at expiration. Data retention, recovery, and cancellation consequences depend on the product. We will coordinate renewal or expiration instructions with the applicable distributor.

9. Full-term commitments, cancellation, and credits

Customer is responsible to NIST Assist for charges for the full term of Microsoft subscriptions ordered or renewed with Customer authorization, including existing annual commitments, subject to lawful cancellation, refund, transfer, or credit rights. Non-use, nonpayment, suspension, or termination of our service relationship does not itself cancel a subscription or release the remaining commitment.

For standard license-based NCE subscriptions, Microsoft generally permits cancellation within seven days (168 hours) after purchase or renewal with a prorated refund, except where law requires otherwise. After the applicable window, cancellation generally is unavailable and committed charges remain payable. Rules differ for some products, upgrades, added licenses, and reductions. Send cancellation or reduction requests immediately to support@nistassist.com and call during support hours; obtain acknowledgment. Requests must be processed within the vendor window, so submitting near its end may be too late. We will process requests promptly during support hours and communicate the result. This procedure does not reduce mandatory customer rights or excuse our own contractual failures.

Microsoft and distributor-approved credits attributable to Customer's subscription will be reflected in Customer's account as applicable. Microsoft service credits depend on the relevant SLA and timely supporting evidence; report outages promptly so we can coordinate an eligible claim. A refund or service credit is not guaranteed merely because it was requested.

Support Policy

10. Hours, contacts, and scope

Standard support hours are 9:00 a.m. to 5:00 p.m. U.S. Central Time, Monday through Friday (CST or CDT as seasonally applicable). Email support@nistassist.com or call (940) 222-5311. Requests received outside those hours are handled during the next support period unless a separate agreement provides after-hours coverage. Any scheduled closure will be communicated. No general 24-hour or guaranteed after-hours coverage is included.

NIST Assist is the first customer contact for billing, licensing, and support for products supplied through us. We triage issues and coordinate escalation with Pax8, TD SYNNEX, Microsoft, or the applicable provider. Managed administration, remediation, consulting, onsite work, and support for products bought elsewhere are included only as stated in the order or SOW; additional work requires agreed pricing. Vendor support obligations are not disclaimed by these scope distinctions.

Report business-wide outages, suspected compromise, and loss of critical access by phone and email with the business impact. We prioritize urgent incidents over routine requests. Response targets, update frequency, maintenance arrangements, and any after-hours charges must be stated in the applicable support plan or SOW; a guaranteed resolution time is not implied. Customer must provide an authorized contact, relevant diagnostic information, and approved access. Do not send passwords, payment credentials, or regulated data in ordinary email.

11. Support recordings

Support calls may be recorded for service documentation, quality, training, security, and dispute resolution. We provide notice before recording and obtain consent where required by law. Inform us if you do not consent so we can arrange a reasonable alternative support method. Routine support-call recordings are retained for 90 days and then deleted, except where a legal hold or applicable legal requirement requires longer retention. Access is restricted to personnel and service providers with a legitimate need and appropriate safeguards. Relevant service notes may be retained under the record-retention criteria in the Privacy Notice.

Customer Data Processing Addendum

12. Processing instructions and safeguards

This addendum applies when NIST Assist processes personal data on Customer's behalf to provide contracted services. Customer determines the lawful purposes and instructions; we act as processor or service provider for that processing. We separately handle our business contact and billing records as described in the Privacy Notice. Processing covers access, storage, administration, troubleshooting, security, and deletion of account, user, device, service, and support data for the engagement. The SOW should identify any special data categories, affected people, systems, and retention requirements.

We process Customer personal data only on documented instructions or as required by law, with confidentiality duties, access controls, appropriate authentication, and reasonable administrative, technical, and physical safeguards. We will inform Customer if we believe an instruction violates applicable data-protection law. Customer must identify special legal, regulatory, residency, or contractual requirements before providing affected data; any additional required terms must be agreed before that processing begins.

13. Providers, incidents, and assistance

Customer authorizes use of service providers necessary for contracted processing, subject to appropriate written data-protection obligations. The applicable vendor or distributor may act under its own agreement for its own processing. We will provide information on relevant processing providers upon request and notify Customer of material additions or replacements where required by the applicable agreement or law, allowing reasonable objections based on data-protection concerns. Microsoft products remain subject to Microsoft's applicable DPA; it does not replace our obligations for our own services.

We will notify Customer without undue delay after becoming aware of a security incident affecting personal data we process for Customer, provide available information and updates, and reasonably cooperate in containment, investigation, and required notices. Each party retains its own legal reporting duties. We will reasonably assist with applicable rights requests, assessments, and compliance inquiries, including providing information necessary to demonstrate our processing obligations. Any audit arrangements will protect other customers' data and system security and comply with applicable law.

At the end of processing, we will return or delete Customer personal data within our control on documented instructions, subject to legal retention duties and agreed backup deletion cycles. We restrict any retained data to permitted purposes. We will cooperate on required safeguards for international transfers before affected processing. Signed customer-specific data-processing terms, including mandatory transfer clauses, take precedence where applicable.

Reference documents

Microsoft Customer Agreement and licensing documents: https://www.microsoft.com/licensing/docs/customeragreement | Microsoft DPA: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA | Microsoft NCE cancellation guidance: https://learn.microsoft.com/en-us/partner-center/customers/new-commerce-cancellation-policy | Microsoft EST guidance: https://learn.microsoft.com/en-us/partner-center/customers/extended-service-terms | Pax8 terms: https://www.pax8.com/en-us/terms/ | TD SYNNEX terms: https://www.tdsynnex.com/us/en/terms-and-conditions.html Applicability depends on the order and governing agreement.

Privacy Notice

NIST Assist LLC | Effective September 8, 2026. This notice describes our handling of personal information in connection with our website, business relationships, licensing, and support. For information processed on a customer's behalf, the Customer Data Processing Addendum and any signed processing agreement also apply.

1. Information and purposes

We collect contact and business details, account and billing records, tenant and licensing information, device and diagnostic information, support correspondence, and support-call recordings. Our website may collect IP addresses, browser and device information, cookie identifiers, and interaction data. Information comes from you, your organization, the systems we are authorized to support, and providers involved in delivering the services. We use it to respond to inquiries, deliver and administer services, bill and maintain accounts, troubleshoot, protect systems, document support, meet legal duties, and improve service quality.

2. Sharing and provider roles

We do not sell customer personal information. We share information as reasonably necessary with providers supporting hosting, communication, licensing, billing, security, and service delivery, and when required by law or to protect legal rights. Microsoft provides cloud and productivity services; Wix hosts our public website; distributors such as Pax8 and TD SYNNEX support applicable licensing and orders. The providers involved depend on the service purchased. Relevant provider information is available upon request. Providers may process information under their own terms for their independent purposes or under processing instructions for services they provide to us. Their privacy notices describe their practices. We apply appropriate contractual safeguards to providers processing data on our behalf.

3. Support calls and retention

We provide notice of support-call recording and obtain consent where required. Tell us if you do not consent so we can arrange a reasonable alternative support method. Routine support-call recordings are retained for 90 days and then deleted, except for legal holds or applicable legal requirements. Access is limited to authorized personnel and providers with a legitimate service need. Other records, including billing, licensing, service notes, and security records, are retained for the time needed for their purpose, the engagement, legal or accounting obligations, and legitimate dispute resolution. We delete or de-identify information when it is no longer needed, subject to legal retention and applicable backup cycles.

4. Security and customer data

We use reasonable administrative, technical, and physical measures appropriate to the information and services, including access restrictions and authentication controls. No service can guarantee absolute security. Report suspected exposure to support@nistassist.com and call (940) 222-5311 for urgent support during published hours. Customer organizations control the data they place in their systems and the instructions they provide us. Requests concerning that data may need to be directed to or coordinated with the relevant customer organization.

5. Privacy requests and choices

Contact privacy@nistassist.com to ask about our practices or request access, correction, deletion, a copy of information, or other rights available under applicable law. We will verify requests as appropriate, respond within applicable legal time limits, explain any lawful denial, and provide an appeal process where required. You may opt out of nonessential promotional communications; necessary service, security, and billing messages may continue. Applicable rights and exemptions depend on the individual, information, and law. We do not claim a blanket exemption merely because a customer operates in a regulated industry.

6. Cookies and international processing

Our Wix website uses technologies for site operation and may use analytics or similar technologies where enabled. Browser controls can restrict or delete cookies, and any site preference controls offered can manage available choices. Blocking some technologies may affect functionality. Where consent is legally required, nonessential processing must follow that consent. Information may be processed where we and applicable providers operate, subject to required transfer safeguards. Contact privacy@nistassist.com for information about the services or data involved.

7. SMS communications

We use mobile numbers for requested one-to-one communications between NIST Assist personnel and customers. Mobile opt-in information and consent are not shared with third parties or affiliates for marketing or promotional purposes. Providers facilitating message delivery may receive information necessary for that purpose. Message frequency varies; message and data rates may apply. You may opt out by notifying us or following applicable opt-out instructions. Consent to promotional messaging is separate from service-related communications.

8. Updates and contact

Material changes will be communicated as required by law, and the effective date will be updated. Contact NIST Assist LLC, 3119 Bourbon Street Circle, Rockwall, TX 75032; privacy@nistassist.com; (940) 222-5311. Service requests: support@nistassist.com. Provider privacy information: https://privacy.microsoft.com/privacystatement | https://www.wix.com/about/privacy | https://www.pax8.com/en-us/terms/