The partner agreement

The partner agreement is published at portal.usesigil.app/partner-agreement. It is the commercial and data protection contract between your MSP and Tophhie Cloud, and it sits alongside rather than inside the terms your clients accept.

Parts of it have pages of their own, because they describe things you do rather than things you agree to: the uptime figure and the support split are covered in support and service level, what happens when a payment fails is in partner billing, and removal is in leaving the programme. This page covers the rest, which is the part most likely to be read by somebody in procurement.

Accepting it

Acceptance is recorded against the partner, with the accepted version, so what was agreed and when is a record rather than an assertion.

Only a partner Owner can accept. It is a commercial and data protection commitment made on behalf of the MSP, which is not something a technician should be able to sign on a service desk shift.

Acceptance gates client work, not sign-in. A partner who has not accepted can sign in and read the console, but inviting a client, requesting a transfer of an existing tenant and releasing a client are all refused until they have. The sub-processor chain has to be agreed before another organisation’s data is handed over.

When the substance of the agreement changes, the version in force moves and every partner is asked to accept the new version. Until they do, the same three actions are refused again. Signing in, reading the console and the clients you already manage are unaffected, so a version bump does not interrupt a client’s signatures.

You accept two documents, not one

Clause 3.2 makes the data processing agreement your Article 28 sub-processing contract, read with your client as the controller, you in place of the customer as its processor, and Tophhie Cloud as your sub-processor. Accepting the partner agreement accepts the DPA on that footing.

The version recorded against you names both documents rather than only the partner agreement, which is what lets you tell a client’s data protection officer exactly which revision of each your acceptance covered.

It also means a revision to the DPA puts you back behind the acceptance gate, in the same way a revision to the partner agreement does. That is the point of recording both. Your clients rely on those terms through you, so the terms cannot be changed underneath a partner who has never seen the new text.

What flows through to your clients

Because the DPA applies between you and Tophhie Cloud, the commitments a direct customer gets are commitments you can pass on: the purpose limitation, the security measures, the named sub-processor list with at least 30 days’ notice before it changes, the UK and EEA storage and transfer safeguards, assistance with data subject requests and impact assessments, and the return and deletion terms. Tophhie Cloud stays liable to you for its own sub-processors.

What the clause does not do is pass through obligations you took on elsewhere. If your own contract with a client commits you to something stricter than the DPA commits Tophhie Cloud to, a shorter breach window or a bespoke audit right or a certification, that stays between you and your client unless Tophhie Cloud has agreed to it with you in writing.

That is worth checking before you sign a client rather than after. An MSP can promise a client a four-hour breach notification; the chain behind it does not tighten to match.

Breach notification reaches you sooner

Where a personal data breach affects a client you manage, you are told what is known at that point within 24 hours, and given the full particulars within 48.

The first of those is sooner than the single 48-hour notice a direct customer gets, and the reason is arithmetic rather than favouritism. The notification your client owes its regulator is theirs to make, and their 72 hours start when they are told. Every hour spent reaching you is an hour taken off that, so the first account arrives incomplete rather than late, with the detail following.

Where you ask for it, or where you cannot be reached, Tophhie Cloud will notify the affected client’s own administrators directly. A controller should not be left uninformed because the chain between you stalled. See if there is a personal data breach for what the notice has to contain.

Using the Sigil name

While you are a partner you may describe yourself as a Sigil partner and use the Sigil name and logo to market the service. The licence is non-exclusive, not transferable, and revocable, and the marks stay Tophhie Cloud’s.

Within that, use the marks as published rather than restyled, recoloured or redrawn. Do not use them in a way that suggests you are Tophhie Cloud, or that something has been endorsed that Tophhie Cloud has not seen, or that the two organisations are in a partnership in the legal sense. Do not register a domain, trading name, trade mark or social account whose name incorporates Sigil’s.

Tophhie Cloud would like to name your organisation and show your logo when describing who its partners are. Say so at any point if you would rather it did not, and it stops.

When the partnership ends the licence ends with it, both ways round, with 30 days to take the other side’s marks off your site and materials.

Confidentiality

Confidentiality runs in both directions and continues for three years after the partnership ends. Each side keeps the other’s confidential information confidential, uses it only for the purposes of the agreement, and passes it only to people in its own organisation, and its professional advisers, who need it.

On Tophhie Cloud’s side that covers your client list, what you charge your clients, and what you say about your business. On yours it covers the rate and discount agreed with you, which is the same figure clause 6 says is not disclosed to your clients, and anything you are told about the workings or security of the service that is not public.

The usual exceptions apply: information already public through no fault of the discloser, information a side already held or worked out independently, and information a third party supplied without a duty of confidence. Neither side is stopped from disclosing what the law, a court or a regulator requires, and each will tell the other first where it is lawfully able to.

None of it stops you telling a client what you need to tell them about the service you sell, including that it runs on Sigil.

Liability, and the cap worth reading twice

Tophhie Cloud’s total liability to you is limited to the fees you paid Tophhie Cloud in the twelve months before the claim.

Those are the fees you paid, not what your clients pay you, and not the combined value of the contracts you hold with them. An MSP can carry obligations to twenty organisations that together far exceed its Sigil bill, and the cap does not scale with them. Insurance is the usual answer, and pricing it in at the start is cheaper than discovering the gap during an incident.

Two other limits are worth knowing. The service credits in clause 5 are the only remedy for a missed availability commitment, so credits and damages cannot both be claimed for the same downtime. Neither side is liable to the other for lost profit, revenue, business, goodwill or anticipated savings, or for indirect loss. Nothing limits liability for death or personal injury caused by negligence, for fraud, or for anything else the law does not allow to be excluded.

Liability runs the other way in two places, both of them things the agreement already asks you not to do. You cover Tophhie Cloud against claims arising from adding or acting on a client without the authority clause 2 requires, and from holding yourself out as Tophhie Cloud rather than as a provider of a service built on Sigil. Both put Tophhie Cloud in front of an organisation it has no relationship with. Nothing else is indemnified.

Support and service level covers the uptime commitment, its credits, and the support split.

Partner billing covers what a failed payment does, including what happens to your clients once the grace period runs out.

Leaving the programme covers ending the arrangement from either side.