Blueclone Networks Services Guide

Services Guide

Published: May 2023 | Last Revised: September 2026

 

Purpose and relationship to the Agreement
This Services Guide describes the operational scope, delivery assumptions, responsibilities, and limitations that may apply to managed, cloud, security, professional, and related services offered by Blueclone Networks, LLC (“Blueclone”). It is incorporated into the Managed Services Agreement (“MSA”) only when referenced by an applicable quotation, proposal, service order, statement of work, work order, or other accepted ordering document (each, a “Requested Services” document).

Only ordered services are included
This Guide is a catalog and operating framework. Blueclone will provide only the Services, quantities, locations, users, devices, systems, features, hours, and service levels expressly identified in the applicable Requested Services document. A description in this Guide does not mean that the Service is included. Anything not expressly included is outside scope and may require a separate Requested Services document and additional fees.

Controlling documents
If this Guide conflicts with the MSA, the MSA controls. A Requested Services document controls service-specific scope, quantities, pricing, term, and expressly negotiated exceptions. The Data Processing Agreement controls Processing and protection of regulated data within its scope. Third-Party Service Provider terms apply to their products and services. Commercial terms—including fees, payment, renewals, termination, liability, and notice—are governed by the MSA and applicable Requested Services document, not repeated in this Guide.

SERVICE LIFECYCLE

Initial discovery and readiness
If included, Blueclone will perform a risk-based, sampling-based review of the Environment to support onboarding and service design. Activities may include asset and configuration review, vendor and warranty review, connectivity assessment, identity and security review, backup review, support-process review, and documentation collection. Discovery is not a certification, penetration test, forensic examination, or guarantee that every issue will be found. Remediation is outside scope unless expressly included.

Onboarding
Onboarding may include deployment or removal of management and security agents; inventory and documentation; configuration of monitoring, patching, backup, identity, email, and security tools; review of network and server status; credential transition; baseline establishment; and recommendations. Timing depends on Client cooperation, credentials, data quality, vendor response, licensing, equipment availability, and remediation needs. Blueclone may revise the onboarding plan when conditions discovered during onboarding require it.

Service commencement and Client delay
Commercial commencement dates and billing are governed by the MSA and applicable Requested Services document. A delay in deployment, onboarding, or go-live caused by missing Client access, information, approvals, prerequisites, facilities, equipment, licensing, or cooperation does not automatically delay the service term or recurring fees. Remediation, repeated work, rescheduling, or expedited work resulting from Client delay may be separately chargeable.

Go live and stabilization
Different Services may begin on different dates. Monitoring, protection, and service-level commitments begin only after the applicable tool is deployed, healthy, licensed, and accepted into management. The initial stabilization and tuning period may involve false positives, configuration changes, incomplete telemetry, and identified remediation. Pre-existing conditions remain Client responsibility unless expressly accepted into scope.

Ongoing service
Recurring Services are delivered according to the selected plan and may combine automation, remote tools, Blueclone personnel, and Third-Party Service Providers. Blueclone may adjust operational methods, tooling, thresholds, and workflows when the change does not materially reduce the contracted outcome. A material change in scope or fees will be handled under the Agreement.

Offboarding
On termination, Blueclone will follow the MSA and an agreed transition plan. Offboarding may include removal or disabling of Blueclone-owned or licensed tools, return of Blueclone equipment, transfer of Client-controlled credentials and documentation, export of available Client Data, and reasonable coordination with an authorized successor. Transition work, data conversion, extended retention, project work, and third-party commitments may be separately chargeable.

Blueclone-owned equipment
Equipment, appliances, and other property supplied by Blueclone but not sold to Client remain Blueclone property. Client shall protect that property, shall not move, alter, repair, encumber, or permit third-party access to it without Blueclone’s approval, and shall return it within ten (10) days after request or termination in substantially the condition received, ordinary wear excepted. Client is responsible for reasonable repair or replacement cost if the property is lost, damaged beyond ordinary wear, or not timely returned.

Credentials and administrative access
Client-owned user and administrator credentials remain Client’s property. Subject to the MSA’s payment and offboarding provisions, Blueclone will provide or transfer Client-controlled credentials and available documentation to Client or its authorized successor. Blueclone’s internal, multi-tenant, provider-level, master, automation, security, and tool credentials remain Blueclone Confidential Information and will not be disclosed. Shared or independently changed administrative credentials may impair security and support.

TABLE OF SERVICES
The following Services are available from Blueclone. Only Services listed in the applicable Requested Services document are included.

Artificial Intelligence Services

AI enablement, governance, administration, agents, copilots, automations, and related advisory services.

Description
AI Services may include readiness assessments, policy and governance assistance, approved AI workspaces, hosted or embedded models, foundation or frontier models, large language models, agents, copilots, automations, integrations, user enablement, monitoring, and administration. The exact features, data flows, providers, usage allowances, and support are limited to the applicable Requested Services document.

Provider neutrality
AI Services may be supplied by one or more Third-Party Service Providers. Blueclone may replace or modify a provider or model when reasonably necessary for availability, security, legal compliance, functionality, or supportability, subject to the Agreement and any material scope or pricing change.

Data handling
Client shall not submit credentials, payment-card data, government identifiers, Protected Health Information, Nonpublic Personal Information, privileged material, export-controlled information, biometric information, or other sensitive or regulated data unless that data type and use are expressly authorized and covered by required agreements. Provider retention, training, residency, deletion, and human-review practices are governed by the selected service and the DPA.

Human oversight
AI output may be inaccurate, incomplete, biased, or unsuitable. Client must use qualified human review and remains responsible for decisions, communications, work product, and actions based on AI output. AI Services may not be used as the sole basis for legal, medical, financial, employment, eligibility, safety-critical, or similarly consequential decisions.

Acceptable use
Client shall maintain appropriate AI governance, user training, access controls, and acceptable-use rules. Prohibited uses include unlawful discrimination, deception, impersonation, infringement, unauthorized surveillance, malicious code, evasion of safeguards, or use that violates provider terms or applicable law.

Applies only when identified in the applicable Requested Services document.

Backup and Disaster Recovery

Managed backup, recovery, continuity, and optional disaster-recovery capabilities for covered systems.

Description
Managed backup may include monitoring, encrypted transfer and storage where supported, recovery-point verification, appliance or cloud administration, and restoration assistance for covered systems. The selected backup type, protected workloads, capacity, frequency, retention, recovery objectives, and recovery methods are stated in the Requested Services document or provider portal.

Recovery
A backup is not a guarantee of successful restoration. Restoration depends on available restore points, data integrity, connectivity, workload condition, destination capacity, provider availability, and the selected service. Recovery time and recovery point objectives are targets only when expressly stated in the Requested Services document.

Client duties
Client must identify critical systems and data, keep covered systems online and accessible, promptly address failed or degraded jobs, maintain required local infrastructure and connectivity, and participate in requested recovery testing. Business continuity, disaster recovery orchestration, forensic recovery, and emergency rebuilds are outside scope unless expressly included.

Applies only when identified in the applicable Requested Services document.

Cloud and SaaS Backup

Backup and recovery for supported cloud applications and Software-as-a-Service data.

Description
Cloud and SaaS Backup may protect supported data in Microsoft 365, Google Workspace, Salesforce, or other identified cloud services. Coverage varies by workload, license, API availability, retention, and provider capability.

Limitations
Native recycle bins, retention features, archives, and legal-hold tools are not substitutes for a separately selected backup service. Client must maintain required source-system licensing, permissions, service accounts, API access, and multifactor-authentication or conditional-access exceptions approved for the integration.

Applies only when identified in the applicable Requested Services document.

Business IT Audit and Strategy

Technology, security, operational maturity, financial efficiency, and strategic roadmap assessments.

Description
Assessments may review technology spending, operations, support maturity, security posture, lifecycle risk, vendor dependencies, documentation, compliance readiness, and alignment with business objectives. Deliverables may include findings, priorities, and a roadmap.

Limitations
An assessment is point-in-time and sampling-based. It is not an audit opinion, certification, penetration test, legal opinion, or guarantee that every weakness will be identified. Remediation is not included unless separately authorized.

Applies only when identified in the applicable Requested Services document.

Credential Exposure and Dark Web Monitoring

Monitoring for exposed credentials and other supported indicators associated with Client-provided identities.

Description
The service searches supported third-party data sources for exposure associated with Client-provided domains, email addresses, or credentials and may present findings in a portal or ticket.

Limitations
Dark-web and credential-exposure sources are incomplete and change continuously. The service cannot detect every compromise, prove whether a credential remains valid, or prevent misuse. Client is responsible for timely password resets, multifactor authentication, user investigation, and other remediation.

Applies only when identified in the applicable Requested Services document.

Security Awareness and Phishing Training

Security education, simulated phishing, reporting, and related workforce risk-reduction services.

Description
Services may include awareness content, micro-training, simulated phishing, policy templates, newsletters, quizzes, and reporting. Frequency, audience, available modules, and administrative features depend on the selected service.

Client duties
Client is responsible for lawful notice to personnel, enrollment data, assignment of training, management follow-up, disciplinary decisions, and any works-council, labor, privacy, or employment requirements. Training reduces risk but cannot eliminate human error or guarantee compliance.

Applies only when identified in the applicable Requested Services document.

Endpoint Security EDR

Managed endpoint malware prevention, behavior detection, response, and related endpoint controls.

Description
Endpoint security may include malware prevention, behavioral detection, exploit protection, web or application controls, endpoint isolation, investigation data, and response capabilities on covered and compatible endpoints.

Limitations
No endpoint product detects or blocks every threat. Protection depends on supported operating systems, healthy agents, current policies, connectivity, proper exclusions, and user behavior. Pre-existing infections, rebuilds, forensic analysis, data recovery, and incident remediation may require separately billable work.

Applies only when identified in the applicable Requested Services document.

Managed Detection and Response XDR

Cross-layer security monitoring, investigation, containment, and response capabilities included in the selected plan.

Description
MDR/XDR may correlate supported endpoint, identity, email, cloud, network, and security telemetry; provide human or automated analysis; and perform authorized response actions such as endpoint isolation, account disablement, or blocking indicators.

Response authorization
Client authorizes Blueclone and approved providers to take reasonable containment actions included in the selected service when delay may materially increase risk. Blueclone will use reasonable judgment, but containment may interrupt legitimate activity. Actions requiring broader business decisions, material downtime, ransom decisions, legal notification, or destructive changes require Client authorization unless emergency authority is expressly documented.

Limitations
Coverage applies only to integrated and healthy data sources. MDR/XDR does not guarantee prevention, detection, attribution, containment, recovery, or regulatory compliance. Full incident response, digital forensics, breach counsel, notification, public relations, and restoration are outside scope unless expressly included.

Applies only when identified in the applicable Requested Services document.

Firewall and Perimeter Security

Configuration, monitoring, maintenance, and support for covered firewall and perimeter devices.

Description
Services may include configuration backup, health monitoring, firmware review, security-policy administration, supported VPN or secure-access configuration, and vendor coordination for covered devices.

Requirements
Covered devices must be supported, properly licensed, under an active vendor support subscription, and configured to Blueclone standards. Material rule changes, redesign, replacement, high-availability projects, new locations, carrier work, and complex VPN changes may be separately billable.

Applies only when identified in the applicable Requested Services document.

Email Security

Protection against phishing, impersonation, business email compromise, spam, malware, and other supported email threats.

Description
Email Security may include inbound and outbound filtering, phishing and impersonation protection, malicious-link or attachment analysis, business-email-compromise controls, encryption, continuity, archiving, or user-reporting features identified in the Requested Services document.

Limitations
No filtering service blocks every malicious message or prevents every account takeover. Client must maintain identity security, multifactor authentication, user training, payment-verification procedures, and domain-security settings. Encryption workflows, retention, continuity, and data residency depend on the selected provider and configuration.

Applies only when identified in the applicable Requested Services document.

Identity and Access Security

Supported identity, multifactor authentication, access, privileged-access, and account-security services.

Description
Identity and Access Security may include multifactor authentication, single sign-on, conditional access, identity monitoring, privileged-access controls, account lifecycle assistance, password policy, and supported directory administration.

Client duties
Client must promptly report personnel changes, approve access, designate authorized contacts, and review privileged and inactive accounts. Blueclone may rely on requests from Authorized Contacts. Identity changes outside agreed workflows or made by other administrators may create security and support risks.

Applies only when identified in the applicable Requested Services document.

Monitoring and Maintenance

Remote monitoring, alerting, maintenance, inventory, and management for covered devices and systems.

Description
Monitoring and Maintenance may include remote-management agents, device inventory, health and capacity alerts, supported service monitoring, routine maintenance, remote connectivity, and policy-based automation for covered systems.

Monitoring boundary
Monitoring is limited to enrolled, online, compatible, and properly configured devices and data sources. A monitoring alert is not proof of an outage, and the absence of an alert is not proof that a system is healthy. Thresholds, suppression, maintenance windows, and response depend on the selected plan and Blueclone’s operational judgment.

Applies only when identified in the applicable Requested Services document.

Remote Help Desk

Remote user and device support under the coverage, hours, priorities, and exclusions of the selected plan.

Description
Remote Help Desk covers eligible users, managed devices, and supported applications during the hours and under the response targets of the selected plan. Blueclone controls triage, assignment, escalation, and whether remote or onsite work is appropriate.

After hours
After-hours service is intended primarily for covered critical incidents and is subject to the selected plan, technician capability, and availability. Non-covered or non-critical after-hours work may be deferred or billed at applicable premium rates. Higher-tier, vendor, onsite, and project resources may be available only during business hours.

Requests
Client must submit requests through Blueclone’s designated portal, support email, or help-desk telephone number. Response measurements begin when a valid request reaches the ticketing system and contain enough information to triage. Direct messages to individual personnel are not a supported notification method.

Applies only when identified in the applicable Requested Services document.

Network and Secure Access Services

Monitoring and management of covered network, Wi-Fi, remote-access, Zero Trust, and secure-access components.

Description
Network and Secure Access Services may include monitoring and management of covered switches, access points, controllers, gateways, remote-access clients, Zero Trust or secure-access policies, DNS security, segmentation, and related cloud management.

Limitations
Performance depends on Client facilities, cabling, power, internet carriers, radio conditions, endpoint capability, capacity, and third-party infrastructure. Bandwidth, coverage, latency, roaming, and uninterrupted connectivity are not guaranteed unless expressly stated after a site assessment. Network redesign, cabling, construction, carrier circuits, and new-site deployment are projects unless included.

Applies only when identified in the applicable Requested Services document.

Professional Services and IT Consulting

Projects, remediation, advisory, implementation, and other work separately authorized by Client.

Description
Professional Services include projects, implementation, migration, remediation, consulting, assessments, data recovery, installations, wiring coordination, and other work outside recurring managed scope. Scope, assumptions, deliverables, dependencies, acceptance, schedule, and fees are governed by an approved Requested Services document.

Managed clients
For a Client with an active Managed Services Agreement, project and one-time work remains governed by that MSA and the applicable project SOW unless the Parties expressly agree otherwise in signed writing. The standalone Consulting and Project Services terms are intended for one-time clients without an active Managed Services Agreement.

Applies only when identified in the applicable Requested Services document.

Security Information and Event Management

Collection, correlation, analysis, and retention of supported security telemetry.

Description
SIEM may collect and correlate telemetry from supported and integrated sources, apply detection logic and threat intelligence, provide investigation or threat hunting, and retain event data for the period included in the selected service.

Limitations
Detection depends on source availability, log quality, ingestion health, retention, use cases, and baseline maturity. Initial tuning may produce false positives or missed anomalies. Unless MDR or response is expressly included, SIEM is monitoring and notification only; remediation and incident response are separate services.

Applies only when identified in the applicable Requested Services document.

Updates and Patch Management

Evaluation, scheduling, deployment, and monitoring of supported operating-system and application updates.

Description
Patch Management may include testing or deferral policies, approval, scheduling, deployment, reboot coordination, and status monitoring for supported operating systems and applications on covered devices.

Limitations
Blueclone may defer or decline an update that appears incompatible, unstable, superseded, unavailable through supported tools, or likely to cause material disruption. Emergency vulnerabilities may require accelerated deployment. Feature upgrades, major-version changes, firmware, line-of-business applications, unsupported software, and remediation of failed updates may require separate work.

Client duties
Client must leave managed devices powered on, connected, and available during maintenance windows; save work; permit required reboots; and identify blackout periods and operational constraints.

Applies only when identified in the applicable Requested Services document.

Voice and Collaboration Services

Facilitation and support of covered voice, messaging, meeting, and collaboration services.

Description
Blueclone may facilitate or support voice and collaboration services supplied by Third-Party Service Providers. Features, service levels, number portability, messaging, recording, emergency calling, taxes, and acceptable use are governed by the selected provider and Requested Services document.

Emergency calling
VoIP emergency calling may differ from traditional telephone service and may fail during power, internet, network, provider, device, or configuration outages. Client must maintain accurate dispatchable-location information for every applicable user and device, promptly update moves and remote-work locations, train users, test as permitted, and maintain an alternate means of emergency communication.

E911 administration and limitations
Client is solely responsible for providing complete and accurate user, device, callback-number, and dispatchable-location information and for promptly notifying Blueclone before any phone, softphone, user, or device is moved or used from a new location. Registration, validation, number portability, and location changes may require processing time before taking effect. Remote and nomadic users must understand that emergency calls may be routed to the wrong answering point or may transmit an incorrect location and should be prepared to state their actual location and callback number verbally. Emergency calling may be unavailable when the applicable voice Service is suspended or disconnected. Client shall notify users of these limitations, comply with the applicable provider’s emergency-service terms, and maintain an independently powered alternative for emergency calls. To the extent permitted by law, Blueclone is not responsible for an emergency-calling failure or misrouting caused by inaccurate or untimely Client information, loss of power or connectivity, device configuration, suspension, portability or registration delay, third-party networks or providers, or other conditions outside Blueclone’s reasonable control.

Regulated features
Client is responsible for laws governing call recording, messaging consent, emergency-location notices, retention, accessibility, and use of automated communications. Blueclone does not provide legal advice regarding these features.

Applies only when identified in the applicable Requested Services document.

Vulnerability Management

Authorized internal and external vulnerability scanning, validation, reporting, and remediation coordination.

Description
Client authorizes recurring, non-destructive internal and external vulnerability scanning of approved in-scope assets as stated in the MSA and Requested Services document. Results may include discovered vulnerabilities, configuration weaknesses, unsupported technology, prioritization, and remediation recommendations.

Scope and safety
Client must identify assets, ownership, hosting-provider restrictions, sensitive systems, exclusions, maintenance windows, and required approvals. Scanning may affect unstable, obsolete, or misconfigured systems. Exploitation, penetration testing, social engineering, denial-of-service, destructive testing, and out-of-scope testing require separate written rules of engagement.

Remediation
Scanning does not guarantee discovery of every vulnerability or prove security. Remediation, validation, exception management, compliance reporting, and risk acceptance are included only when stated in the selected service.

Applies only when identified in the applicable Requested Services document.

Website Hosting and Management

Supported website hosting, maintenance, security, availability, and related administration.

Description
Website services may include supported hosting, platform maintenance, backups, availability monitoring, security controls, DNS or certificate assistance, and content or development work stated in the Requested Services document.

Client duties and limitations
Client is responsible for content, intellectual-property rights, privacy notices, accessibility, ecommerce obligations, credentials, and lawful collection of visitor information. Availability and performance depend on third-party infrastructure, plugins, themes, traffic, code, DNS, and external services. Development, redesign, SEO, accessibility remediation, incident recovery, and emergency restoration are separate unless included.

Applies only when identified in the applicable Requested Services document.

SERVICE DELIVERY STANDARDS

Support channels
Requests must be submitted through the designated client portal, support email, or help-desk telephone number. Critical issues should be reported by telephone in addition to creation of a ticket. Blueclone is not responsible for delay caused by requests sent through unmonitored channels or directly to individual personnel.

Priority and response
Blueclone assigns priority based on business impact, urgency, affected users, available workaround, security risk, and information provided. Response targets are service objectives, not guaranteed resolution times, and apply only to covered Services during applicable coverage hours. Client-caused delay, inaccessible systems, vendor dependency, parts, carrier issues, force majeure, and work outside scope pause or exclude measurement.

Remote first and onsite work
Blueclone will use remote service when reasonably practical. Onsite work is scheduled when Blueclone determines physical presence is appropriate and is subject to technician availability, location, access, safety, travel, and the selected plan. Onsite labor and travel are included only when expressly stated.

Onsite readiness and minor tasks
Before an onsite visit, Client must provide an authorized contact, safe and timely access, suitable workspace, required building or landlord approvals, power, connectivity, equipment, and accurate site information. Incidental tasks reasonably necessary to complete covered work may be performed when practical, but cabling, construction, electrical work, furniture movement, hazardous work, lift work, and work requiring a licensed trade are outside scope unless expressly included. Delay, repeat visits, or standby time caused by site conditions or unavailable Client resources may be billable.

Maintenance windows and emergency changes
Blueclone may perform routine maintenance, patching, reboots, tool deployment, configuration changes, testing, and other covered work during agreed or reasonably selected maintenance windows. Client must identify blackout periods and systems requiring special approval. Blueclone may take urgent action outside a maintenance window when reasonably necessary to address an active threat, critical vulnerability, provider requirement, material outage, or safety risk, with notice when practicable. Maintenance can cause temporary degradation or interruption and may depend on Client and vendor availability.

Scheduled appointments, travel, and after-hours work
Unless expressly included, travel time, mileage, tolls, parking, lodging, and related expenses may be billed at the rates stated in the Agreement or Blueclone’s then-current rates. Blueclone may charge for reserved time when Client cancels without reasonable notice, is unavailable, or fails to provide scheduled access. Non-covered, non-critical, or Client-requested after-hours work may be deferred or billed at applicable premium rates.

Fair use of uncapped or unlimited support
A Service described as “unlimited,” “uncapped,” or similar is subject to reasonable and customary business use by covered users and devices and does not include projects, training, repeated remediation of Client-caused conditions, support for excluded items, or abusive, excessive, automated, or unusually resource-intensive requests. If use materially exceeds the assumptions of the selected plan, Blueclone may discuss corrective measures and, upon notice, require a plan or scope adjustment, apply applicable out-of-scope rates, or treat identified work as a project under the Agreement.

Monitoring versus response
“24×7 monitoring” means applicable tools may collect telemetry and generate alerts continuously. It does not mean every alert is reviewed or remediated immediately, nor that all Services, technicians, vendors, or onsite resources are available 24×7. Response and remediation follow the coverage and escalation terms of the selected plan.

Authorized contacts and changes
Blueclone may rely on directions and approvals from Client’s Authorized Contacts. Client must promptly update contacts and personnel status. Material changes to users, devices, locations, systems, applications, security controls, cloud tenants, networks, or other managed assets must be coordinated with Blueclone and may change scope or fees.

Vendor and platform changes
A Third-Party Service Provider may change or discontinue products, terms, pricing, security, functionality, integrations, support, minimum commitments, or availability. Blueclone may add, replace, or migrate a provider when reasonably necessary for security, compliance, service quality, compatibility, or continued delivery. A vendor change may require migration, implementation, configuration, replacement hardware, licensing, training, or other work and may increase recurring or non-recurring fees under the MSA or an accepted Requested Services document.

Security recommendations and risk acceptance
Blueclone may recommend security, lifecycle, backup, resilience, compliance, or operational improvements. Client is responsible for timely approval and implementation. If Client declines, delays, disables, or prevents a recommendation or required control, Blueclone may document risk acceptance, modify support conditions, exclude the affected asset, require a waiver, adjust fees, suspend affected Services, or exercise rights under the MSA.

Suspension and restoration
If a Service is suspended under the MSA, monitoring, protection, support, backup, communications, licensing, and other functions may be reduced or unavailable. Before restoration, Blueclone may require payment, updated authorization, reactivation charges, security or health validation, credential changes, remediation, redeployment of tools, and confirmation that the Environment remains supportable. Restoration timing depends on those conditions and Third-Party Service Provider availability.

Advisory roles
Virtual CIO, virtual CISO, strategy, compliance-readiness, and other advisory Services are consultative only. Blueclone and its personnel do not become Client’s officer, director, employee, fiduciary, legal counsel, compliance officer, CTO, CISO, or other statutory or executive role. Client may not identify Blueclone or its personnel in a corporate filing, insurance application, regulatory submission, customer representation, or public statement as holding such a role without Blueclone’s prior written approval.

CLIENT RESPONSIBILITIES AND MINIMUM REQUIREMENTS

  • All covered hardware, operating systems, applications, firmware, and cloud services must be genuine, properly licensed, vendor-supported, and reasonably serviceable.
  • Covered endpoints and systems must run required Blueclone management, monitoring, security, and backup agents without unauthorized removal, disablement, or interference.
  • Client must provide timely administrative access, vendor access, documentation, approvals, maintenance windows, facilities access, and cooperation reasonably required to provide the Services.
  • Client must maintain reliable internet, power, environmental controls, supported network equipment, surge protection or UPS protection where appropriate, and active manufacturer or vendor support when required.
  • Client must maintain appropriate cyber insurance, business continuity planning, alternate communication methods, and backups for data or systems not expressly covered by Blueclone.
  • Client must promptly report suspected security incidents, lost devices, suspicious messages, unauthorized access, personnel changes, legal holds, and material changes to the Environment.
  • Client must identify legal, regulatory, contractual, geographic, sovereignty, retention, accessibility, safety, or industry requirements before Blueclone Processes affected data or designs the Service, including applicable flow-down or up-chain duties imposed by customers, patients, members, business associates, prime contractors, subcontractors, vendors, licensors, lenders, insurers, grants, government contracts, or supply-chain relationships.
  • Client must provide applicable security exhibits, data restrictions, audit terms, reporting deadlines, and other operative provisions for Blueclone’s review. Blueclone is bound only to requirements expressly accepted in a signed Requested Services document or addendum.
  • Client must ensure that it owns or has authority to administer, scan, monitor, back up, access, and provide Blueclone access to all in-scope assets and data.

GENERAL EXCLUSIONS

Unless expressly included in the applicable Requested Services document, the following are outside scope and may require separate authorization and fees:

  • Hardware, software, subscriptions, parts, shipping, taxes, carrier charges, vendor support incidents, warranties, renewals, and third-party fees unless expressly included.
  • Projects, migrations, implementations, redesigns, major upgrades, new locations, relocations, mergers, acquisitions, divestitures, office moves, cabling, construction, and equipment refreshes.
  • Support for unmanaged, unlicensed, unsupported, obsolete, unauthorized, personally owned, home, or out-of-scope devices, systems, users, applications, accounts, and locations.
  • Custom software development, website development, database development, report development, integration development, scripting, training, and business-process design unless expressly included.
  • Digital forensics, e-discovery, breach counsel, legal or regulatory notification, public relations, ransom negotiation or payment, litigation support, and expert testimony.
  • Incident recovery, large-scale restoration, ransomware rebuild, data reconstruction, and remediation of pre-existing compromise unless expressly included.
  • Failures or delay caused by Client or third parties, unauthorized changes, unavailable credentials, inadequate access, carrier or utility outage, vendor defects, supply-chain delay, force majeure, or unsafe conditions.
  • Guarantees of uninterrupted operation, prevention or detection of every threat, recovery of every file or system, regulatory compliance, certification, or a particular business outcome.

CO-MANAGED ENVIRONMENTS

Where Client personnel or other providers administer systems that overlap with Blueclone’s Services, Client will define authority, ownership, escalation, and change-control responsibilities. Blueclone is not responsible for acts or omissions of another administrator or provider. Conflicting changes, shared credentials, incomplete documentation, or restricted access may affect security, service levels, and fees. Blueclone may require a responsibility matrix, administrative-access controls, or written risk acceptance.

ACCEPTABLE USE POLICY

This Acceptable Use Policy applies to hosted, cloud, security, communications, AI, and other technology Services provided or facilitated by Blueclone.

Illegal, harmful, or abusive activity
Client shall not use Services to violate law or third-party rights; facilitate fraud, harassment, threats, exploitation, or harm; distribute malware; attack, probe, overload, or gain unauthorized access to systems; evade security controls; or interfere with another user or service.

Messaging and identity abuse
Spam, unlawful automated messaging, phishing, impersonation, forged headers, deceptive identities, credential theft, and unauthorized collection of personal data are prohibited.

Resource abuse
Unauthorized cryptocurrency mining, denial-of-service activity, open proxies, excessive consumption of shared resources, and operation that materially degrades a service are prohibited.

High-risk use
Unless Blueclone expressly agrees in a signed Requested Services document designed for that purpose, Client shall not use the Services in life-support, emergency-dispatch, medical-device, clinical-treatment, nuclear, aviation, autonomous-vehicle, industrial-control, weapons, or other environment in which a failure, delay, error, or interruption could reasonably be expected to cause death, personal injury, or severe physical, property, or environmental harm.

Content and intellectual property
Client shall not store, transmit, generate, or distribute unlawful content or material that infringes privacy, confidentiality, copyright, trademark, patent, trade secret, publicity, or other rights.

AI-specific restrictions
Client shall not use AI Services for malicious code, deceptive impersonation, unlawful surveillance, evasion of safeguards, infringement, prohibited automated decision-making, or processing of restricted data not approved for the selected AI Service.

Enforcement
Blueclone may investigate suspected abuse and may restrict, suspend, preserve, or remove affected access or content when reasonably necessary to protect the Services, other clients, third parties, or comply with law or provider requirements. Blueclone will provide notice when reasonably practicable.

THIRD-PARTY SERVICES AND DATA PROCESSING

Third-Party Services are governed by applicable provider terms identified at https://www.blueclone.com/tc-3rdparty/ or in the Requested Services document. Processing of Client Personal Data is governed by the Blueclone Data Processing Agreement at https://www.blueclone.com/bcn-dpa/ when applicable. Client must review and comply with provider terms and must notify Blueclone before using a Service for regulated or restricted data.

GUIDE UPDATES

Blueclone may update this online Services Guide under the notice and change-control provisions of the MSA. Updates apply prospectively. Material changes to contracted scope, committed term, or pricing require the process stated in the MSA and applicable Requested Services document.