Terms of Engagement

Jordan Gall · ABN 68 170 885 814 · Version 2.0 · Last updated 27 October 2026

These Terms of Engagement (“Terms”) set out how Jordan Gall (ABN 68 170 885 814) (“we”, “us”, “our”) provides cyber security, IT support and hosted services to you (the “Client”, “you”, “your”).

You agree to these Terms when you accept a quote (including a quote from our online quote builder), sign up to a Plan or Hosted Service, ask us to start work, or pay an invoice. These Terms, together with your Quote and anything the Quote refers to, make up the agreement between us (the “Agreement”).

If your Quote and these Terms are inconsistent, the Quote wins, except clauses 9 (No guarantee) and 11 (Liability). Those clauses win unless the Quote expressly says it changes them.

1. Key terms

• Quote means a written quote, proposal or statement of work from us, including a PDF quote from our quote builder and any agreed variation.
• Plan means a monthly plan (Essentials, Enhance or Complete) or a monthly service chosen individually.
• Project means one-off work, such as Audit & Consult, Secure Start, email domain protection setup, backup setup, an Essential Eight gap assessment, a team training session, a migration, or a prepaid support block.
• Hosted Service means an application we host for you, for example through hosting.jordangall.com.
• Cyber Incident means any actual or suspected unauthorised access to, or use, disruption, encryption, corruption, loss or disclosure of, your systems, accounts, devices or data. It includes malware, ransomware, phishing, business email compromise, payment-redirection fraud, account takeover, denial of service and data breaches, whoever causes them.
• Client Systems means the accounts, tenants, devices, networks, software, websites, domains and data you use, whoever provides them.
• Third-Party Products means software, cloud services, hardware and services not made by us. For example: Microsoft 365, Google Workspace, Microsoft Defender, Intune, backup services, domain registrars, website hosts and Cloudflare.

2. Our services

We provide the services described in your Quote (the “Services”). These may include Plans, Projects, Hosted Services and hourly work.

Our website and quotes describe each service in plain English. What you actually receive is the service as described in your Quote, including the “You get” points for each service. We may improve how we deliver a service, as long as the overall standard is not materially reduced.

2.1 Secure Start comes first

Every Plan starts with Secure Start, a one-off Project that brings your environment up to the Plan's baseline: settings, sign-in protection, email protection, device enrolment and documentation. Our monthly services are designed to keep that baseline in place. If you ask us to skip, shorten or delay Secure Start, you accept that our monthly services will run on an environment that may not meet the baseline, and clause 11.4 applies.

2.2 Care and timing

We will perform the Services with due care and skill, in line with good industry practice for small-business cyber security, and within a reasonable time. Timeframes are estimates unless the Quote says they are fixed.

3. Scope, estimates and changes

• The Services are limited to what your Quote describes. Anything else is out of scope.
• Out-of-scope work is charged at $120 per hour (business hours) or $180 per hour (urgent or after-hours) unless agreed otherwise. We will agree it with you before starting, except in an emergency where you, or someone you have authorised, asks us to act straight away.
• Items marked ESTIMATE are confirmed in writing after a short call, before work starts. If we expect to exceed a confirmed estimate by more than [15%], we will tell you and get your approval before continuing.
• Quotes are valid for 30 days from the date shown on them.
• Changes to scope, fees or timing (“Variations”) must be agreed in writing. Email is fine.

4. Software, licences and third-party products

• We do not resell software or add mark-ups. You buy licences directly from the vendor, in your name, and you pay the vendor directly. You own your accounts and your data.
• Our fees do not include licences, subscriptions or third-party charges (for example Microsoft 365 Business Premium, Defender, Intune, backup services, domain renewals or website hosting) unless your Quote expressly says so. Your Quote identifies what is “Not included”.
• Third-Party Products are supplied by their vendors under the vendors' own terms. We are not responsible for their availability, outages, defects, security vulnerabilities, changes, data handling or data loss.
• If part of a service depends on a licence or product you have not bought, we cannot deliver that part. The fee is not reduced unless we agree in writing.

5. Your responsibilities

Cyber security is a shared responsibility. To let us deliver the Services, you agree to:

• give us accurate, complete and timely information, access and cooperation;
• make sure you have authority to give us access to the Client Systems and data involved, including any consents needed from staff, other users or third parties;
• keep your licences and subscriptions current;
• tell us promptly about changes that affect security, such as staff joining or leaving, new systems or devices, new suppliers, or anything suspicious;
• not make changes that weaken security controls we have put in place (for example disabling multi-factor authentication) without telling us first;
• make sure your staff follow your security policies and the reasonable guidance we give; and
• meet your own legal, regulatory, contractual and insurance obligations, including any obligation to notify individuals, regulators or your insurer after a Cyber Incident. We can help, but these obligations remain yours.

5.1 Accepted risks

Sometimes you may decline or delay a recommendation, ask us to exclude or disable a control, remove a service from a Plan, or choose not to buy a licence we recommend. In each case you accept the associated risk. We may confirm the accepted risk with you in writing, and email is enough. We are not responsible for outcomes that our recommendation was designed to prevent.

6. Access to your systems

• You give us the access described in your Quote, or the access we reasonably need to deliver the Services. Where practical we use least-privilege access, protect our administrative accounts with multi-factor authentication, and use access only to deliver the Services.
• We may use management, monitoring and remote-support tools that collect technical information about your devices and accounts.
• You can withdraw our access at any time. Services that depend on that access will then stop, and fees already payable remain payable.
• When the Agreement ends, we will hand over the administrative access and documentation we hold for you and remove our own access. We will never withhold your accounts, data or administrative access as leverage in a fee dispute.

7. Training and simulated phishing

Where your Services include staff training or practice scam emails, you authorise us to send simulated phishing messages to your staff and to report the results to you. You are responsible for telling your staff about the program, as your workplace policies and employment obligations require. [CONFIRM wording with your lawyer for workplace surveillance and employment law in your clients' states.] We do not make employment decisions. How you use the results is your responsibility.

8. Incidents and urgent support

• If you suspect a Cyber Incident, contact us immediately by phone. Also notify your insurer as your policy requires. Many cyber insurance policies require you to use the insurer's incident response panel, and we will cooperate with it.
• Response targets in your Plan (such as priority response) are targets for starting work. They do not guarantee resolution or outcome times.
• Unless your Plan or Quote includes it, incident response work is charged at our hourly rates, with the urgent rate applying after hours.
• During an incident, we may take urgent containment steps we reasonably believe are needed, such as disabling accounts, resetting passwords, revoking sessions or isolating devices, even if they cause disruption. You authorise these steps. We are not liable for disruption caused by reasonable containment action.
• Decisions during an incident are yours. These include whether to pay a ransom, shut down systems, contact police, or notify customers, regulators or the Office of the Australian Information Commissioner. We will give you our recommendations. We do not negotiate with, or make payments to, threat actors.

9. Cyber security has no guarantees

You acknowledge and agree that:

• cyber security reduces risk; it cannot eliminate it. We do not guarantee that your Client Systems, data or business will be free from Cyber Incidents, or that any control will stop every attack;
• Cyber Incidents are usually caused by criminals or other third parties outside our control. A Cyber Incident happening does not, by itself, mean we failed to perform the Services with due care and skill;
• audits, assessments, scores (including Microsoft Secure Score), the online Risk Check and Essential Eight alignment tracking are point-in-time measures. They are based on the information and access available to us and may not find every weakness. Essential Eight alignment tracking is not a certification;
• we do not guarantee outcomes that depend on third parties, such as an insurer accepting or renewing cover, a tender result, or a certification decision; and
• threats change constantly, and controls that are effective today may not stay effective.

10. Fees and payment

• All prices are in Australian dollars and exclude GST. GST is added to invoices.
• Plans are billed monthly in advance [on the 1st of each month, with the first month pro-rated — CONFIRM]. Plan prices are based on the number of people in your Quote. If your headcount changes, the price adjusts from the following month.
• Projects are billed as set out in the Quote. [For Projects over $1,000 we may ask for a 50% deposit before starting, with the balance on completion — CONFIRM.]
• Prepaid support blocks are valid for 6 months from purchase. Hours included in a Plan (for example the 2 hours of hands-on help each month in Complete) do not roll over and cannot be redeemed for cash.
• Hourly work is billed in [15-minute] increments.
• Invoices are payable within [14] days. If you dispute part of an invoice, tell us within 14 days and pay the undisputed part.
• If an invoice is overdue, we may suspend non-urgent Services after giving you [7] days' written notice. Suspension never affects clause 6 (handover of your access).
• We may change Plan prices by giving you at least 30 days' written notice. You may cancel before the change takes effect.

11. Liability

11.1 Australian Consumer Law

Nothing in this Agreement excludes, restricts or modifies any consumer guarantee, right or remedy under the Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010 (Cth)) or any other law that cannot lawfully be excluded (“Non-excludable Rights”). Clauses 11.2 to 11.9 apply subject to this clause.

11.2 Limitation where permitted

Where the Services are not of a kind ordinarily acquired for personal, domestic or household use, our liability for failing to comply with a consumer guarantee is limited, at our option, to supplying the Services again or paying the cost of having them supplied again.

11.3 Cyber Incidents

We are not liable for any loss, damage, cost or liability arising from or in connection with a Cyber Incident affecting you, your Client Systems, your staff, your customers or your data, except to the extent the loss is directly caused by our breach of this Agreement or our negligence. Any liability we do have is reduced in proportion to the extent other factors contributed to the loss, including the acts of the attacker, you, your staff and Third-Party Products. That liability is also subject to clauses 11.4 to 11.7.

11.4 Specific exclusions

We are not liable for:

• money paid or transferred to fraudsters, including through invoice or payment-redirection scams and business email compromise;
• ransom or extortion payments;
• fines, penalties or infringement notices, to the extent the law permits this exclusion;
• costs of notifying individuals or regulators, credit or identity monitoring, public relations, or legal advice following a Cyber Incident;
• loss arising from an accepted risk under clause 5.1, a service you declined or removed, a licence you did not buy, a recommendation you did not implement, or Secure Start being skipped or incomplete;
• the failure, outage, vulnerability or data loss of a Third-Party Product; or
• a Cyber Incident or compromise that began before we started providing the relevant Services.

11.5 Indirect loss

We are not liable for any indirect or consequential loss, or for loss of profit, revenue, business, contracts, goodwill, anticipated savings or data, or for business interruption, however it arises.

11.6 Cap on liability

Our total aggregate liability arising out of or in connection with this Agreement and the Services, whether in contract, tort (including negligence), under statute or otherwise, is capped at the total fees you paid us in the 12 months immediately before the event first giving rise to the liability. For a one-off engagement, the cap is the fees paid for the relevant Project. [CONFIRM: alternatively a fixed amount. Whichever you choose, make sure your professional indemnity insurance limit is at least the cap.]

11.7 Your insurance

We strongly recommend that you hold cyber insurance suitable for your business. Choosing your level of cover, and meeting your policy's conditions, are your responsibility.

11.8 Your indemnity

You indemnify us against third-party claims arising from: your lack of authority to give us access to Client Systems or data; work we carry out on your instructions; or your use of our deliverables against our advice. This indemnity is reduced to the extent the claim is caused by our breach or negligence.

11.9 Allocation of risk

Our fees reflect the allocation of risk in this clause 11. Each party must take reasonable steps to reduce any loss it suffers.

12. Hosted Services

• Hosted Services run on infrastructure we operate [in Australia — CONFIRM] and are offered as monthly subscriptions, paid by card through our payment provider (Stripe). You can cancel at any time, and cancellation takes effect at the end of the current billing period.
• You are responsible for your users and their sign-in details. Multi-factor authentication is required.
• Your content remains yours. You give us permission to store, process and back up it only as needed to provide the Hosted Service.
• We take regular backups. Even so, you should keep your own copy of anything important. Automated maintenance and security updates run daily around 5:00 am Sydney time and may cause brief interruptions. We do not guarantee uninterrupted availability.
• You must not use Hosted Services for unlawful content, malware, spam, intellectual property infringement, or to attack other systems. We may suspend a Hosted Service to protect it, other users or third parties.
• When you cancel, we keep your data for 7 days so you can change your mind or download it. After that it is permanently deleted. You can ask us to delete it immediately.
• Some Hosted Services are built on open-source software and are provided under the relevant licences. Features may change when that software is updated.
• For Hosted Services, the cap in clause 11.6 is the fees you paid for that Hosted Service in the previous 12 months.

13. Confidentiality

Each party will keep the other's confidential information secure, use it only for the purposes of this Agreement, and disclose it only to people who need to know it and are bound by similar obligations, or where the law requires. This clause survives termination.

14. Privacy and data

• Each party will comply with applicable privacy laws. We handle personal information as described in our Privacy Policy at jordangall.com/privacy.html.
• Where we handle personal information about your staff or customers on your behalf, we do so only as needed to provide the Services and we take reasonable steps to protect it.
• If we become aware of a suspected data breach affecting personal information we hold for you, we will tell you without undue delay [and in any case within 72 hours — CONFIRM]. We will help you assess it. Deciding whether to notify, and notifying, remain your responsibility unless we agree otherwise.

15. Intellectual property

• Each party keeps ownership of the materials, tools, templates, methods and know-how it owned before the engagement or develops independently.
• Once you have paid in full, you may use the reports, policies and deliverables we prepare for you for your internal business purposes, including sharing them with your insurer, auditors and clients. [CONFIRM: licence or transfer of ownership.]
• We may use the general skills and experience we gain, and anonymised, non-identifying information, to improve our services.

16. Term and ending the Agreement

• Plans are rolling monthly with no lock-in. Either party may cancel a Plan with 30 days' written notice. Fees are payable up to the end of the notice period.
• Either party may end the Agreement by written notice if the other party materially breaches it and does not fix the breach within 14 days of being asked to, or if the other party becomes insolvent.
• If we end a Plan without cause, we will refund any fees you paid in advance for the period after it ends.
• When the Agreement ends, you must pay for Services performed and costs reasonably incurred up to that point, and clause 6 applies to handover.
• Clauses that by their nature should survive (including clauses 9, 11, 13, 14 and 15 and payment obligations) continue after the Agreement ends.

17. Insurance

We hold [professional indemnity insurance with a limit of $___ and cyber liability insurance — CONFIRM]. We will give you a certificate of currency on request.

18. Subcontractors

We may use subcontractors to help deliver the Services, but we remain responsible to you for their work. We will not give a subcontractor access to your Client Systems without telling you first.

19. Disputes

If a dispute arises, either party may give written notice of it. We will both try in good faith to resolve it within 20 business days. If it is not resolved, either party may refer it to mediation in New South Wales before starting court proceedings. This does not stop either party seeking urgent court relief.

20. General

• Notices may be given by email to the addresses in your Quote or the most recent address the other party has told you about.
• Force majeure: neither party is liable for delay or failure caused by events beyond its reasonable control.
• Assignment: you may not transfer this Agreement without our written consent.
• Changes to these Terms: we may update these Terms by giving you 30 days' written notice. If you do not accept the change, you may cancel your Plan before it takes effect. The current version is published at jordangall.com/terms-of-engagement.html.
• Entire agreement: this Agreement is the entire agreement between us about its subject matter and replaces earlier discussions.
• Governing law: the laws of New South Wales apply, and the parties submit to the non-exclusive jurisdiction of its courts.
• Severability: if any provision is unenforceable, it is read down or severed, and the rest continues in force.

21. Acceptance

By accepting a Quote, signing up to a Plan or Hosted Service, asking us to proceed, or signing below, you confirm that you have read and agree to these Terms of Engagement.

To accept in writing, reply to your quote email confirming acceptance, or ask for a copy to sign.