Terms of Service

Effective Date: May 2026

1. Introduction and Acceptance

These Terms of Service ("Terms") govern the access to and use of consulting services, deliverables, and related materials (collectively, the "Services") provided by The Atoll Group LLC ("The Atoll Group," "we," "us," or "our") to the business entity identified in the applicable Statement of Work or service agreement ("Client," "you," or "your"). By engaging The Atoll Group for Services, Client acknowledges and agrees to be bound by these Terms.

These Terms apply to all Services provided by The Atoll Group unless expressly superseded by a separately executed Master Services Agreement or other written agreement between the parties. In the event of a conflict between these Terms and any Statement of Work ("SOW"), the SOW controls with respect to the subject matter of that SOW.

2. Services

2.1 Scope. The Atoll Group provides consulting services in the areas of data privacy, intelligence, cybersecurity, information security, and operational risk management for organizations, executives, and/or its offices. The specific scope, deliverables, timeline, and fees for each engagement will be set forth in one or more SOWs executed by both parties.

2.2 Standard of Performance. The Atoll Group will perform all Services in a professional and workmanlike manner, consistent with generally accepted industry standards and practices applicable to similar consulting engagements.

2.3 Advisory Nature of Services. All Services are advisory in nature. Certain engagements may include legal guidance provided by The Atoll Group's licensed attorney. Where legal guidance is provided, it will be identified as such in the applicable SOW and is limited to the specific matters described therein. Legal guidance does not create an attorney-client relationship between The Atoll Group's attorney and the Client unless a separate engagement letter expressly establishing such a relationship is executed by the parties.Client remains solely responsible for all decisions regarding its own compliance, security posture, and risk management, including the decision to implement or decline any recommendation(s) provided by The Atoll Group.

2.4 Client Cooperation. Client acknowledges that The Atoll Group's ability to perform the Services depends on Client's timely cooperation, including providing access to relevant systems, personnel, documentation, and information. Delays caused by Client's failure to cooperate will not constitute a breach by The Atoll Group and may result in adjusted timelines and additional fees.

3. Fees and Payment

3.1 Fees. Client agrees to pay The Atoll Group the fees specified in each SOW. Unless otherwise stated in a SOW, all fees are quoted in U.S. dollars.

3.2 Invoicing and Payment Terms. The Atoll Group will invoice Client in accordance with the payment schedule set forth in the applicable SOW. Unless otherwise specified, all invoices are due within thirty (30) days of the invoice date.

3.3 Late Payments. Overdue amounts will accrue interest at a rate of 1.5% per month (or the maximum rate permitted by applicable law, whichever is less), calculated from the due date until paid in full.

3.4 Expenses. Client will reimburse The Atoll Group for reasonable, pre-approved, out-of-pocket expenses incurred in connection with the performance of Services, including travel, lodging, and third-party tools or licenses required for the engagement.

3.5 Taxes. All fees are exclusive of applicable taxes. Client is responsible for all sales, use, value-added, withholding, and similar taxes arising from the Services, excluding taxes based on The Atoll Group's net income.

4. Confidentiality

4.1 Definition. "Confidential Information" means all non-public information disclosed by one party ("Disclosing Party") to the other ("Receiving Party") in connection with the Services, whether orally, in writing, electronically, or by inspection, including business plans, technical data, security assessments, vulnerabilities, audit findings, financial information, and proprietary methodologies.

4.2 Obligations. The Receiving Party will: (a) hold Confidential Information in strict confidence; (b) not disclose it to any third party except to its employees, contractors, or advisors who have a need to know and are bound by confidentiality obligations at least as protective as those in this Section; and (c) not use Confidential Information for any purpose other than the performance or receipt of the Services.

4.3 Exclusions. Confidential Information does not include information that: (a) is or becomes publicly available without breach of these Terms; (b) was known to the Receiving Party prior to disclosure without restriction; (c) is independently developed by the Receiving Party without use of the Confidential Information; or (d) is received from a third party without restriction and without breach of any obligation of confidentiality.

4.4 Compelled Disclosure. If the Receiving Party is compelled by law, regulation, or legal process to disclose Confidential Information, it will provide the Disclosing Party with prompt written notice (to the extent legally permitted) and cooperate with the Disclosing Party's efforts to obtain protective treatment of such information.

4.5 Security Findings. The parties acknowledge that Confidential Information exchanged under these Terms may include sensitive security vulnerability data, penetration testing results, and risk assessment findings. Both parties agree to apply enhanced safeguards to such information, including encryption in transit and at rest and access limited to personnel directly involved in the engagement.

4.6 Attorney-Client Privilege. Where an engagement includes legal guidance provided by The Atoll Group's licensed attorney pursuant to a separately executed engagement letter, certain communications between the Client and The Atoll Group's attorney may be protected by attorney-client privilege. The confidentiality obligations set forth in this Section 4 are in addition to, and do not limit or waive, any protections afforded by attorney-client privilege or the work product doctrine. Neither party will take any action that would waive or diminish such privilege without the prior written consent of the other party. In the event of a conflict between this Section 4 and the terms of a separate attorney engagement letter regarding privileged communications, the attorney engagement letter will control.

5. Intellectual Property

5.1 The Atoll Group IP. The Atoll Group retains all right, title, and interest in and to its pre-existing intellectual property, proprietary methodologies, frameworks, tools, templates, know-how, and general knowledge (collectively, "Atoll IP"), including any improvements or modifications thereto made during the course of an engagement.

5.2 Deliverables. Subject to Section 5.1 and Client's full payment of all fees, The Atoll Group grants Client a non-exclusive, non-transferable, perpetual license to use the deliverables produced under a SOW for Client's internal business purposes. Deliverables may not be resold, sublicensed, or distributed to third parties without The Atoll Group's prior written consent.

5.3 Client IP. Client retains all right, title, and interest in its pre-existing intellectual property. Client grants The Atoll Group a limited, non-exclusive license to use Client's materials solely as necessary to perform the Services.

5.4 Feedback. To the extent Client provides suggestions, ideas, or feedback regarding The Atoll Group's methodologies or tools, The Atoll Group is free to use and incorporate such feedback without restriction or obligation.

6. Data Protection

6.1 Compliance. Each party will comply with all applicable data protection and privacy laws in connection with its performance under these Terms, including, where applicable, the California Consumer Privacy Act (as amended), state comprehensive privacy laws, the General Data Protection Regulation (EU) 2016/679, and any other applicable data protection legislation. For more information please refer to our Privacy Policy.

6.2 Data Processing. To the extent The Atoll Group processes personal data on behalf of Client, the parties will execute a separate Data Processing Agreement ("DPA") that will supplement these Terms. In the event of a conflict between these Terms and the DPA regarding the processing of personal data, the DPA will control.

6.3 Security Measures. The Atoll Group will maintain administrative, technical, and organizational security measures appropriate to the nature of the data accessed or processed during the engagement. The Atoll Group will promptly notify Client of any confirmed security incident affecting Client's data.

7. Representations and Warranties

7.1 Mutual Representations. Each party represents and warrants that: (a) it has the authority to enter into and perform its obligations under these Terms; (b) its performance will not violate any applicable law or regulation; and (c) it will comply with all applicable anti-bribery and anti-corruption laws.

7.2 The Atoll Group Warranties. The Atoll Group warrants that:

(a) the Services will be performed in accordance with Section 2.2;

(b) to its knowledge, the deliverables will not infringe any third-party intellectual property rights;

(c) where an engagement includes legal guidance as identified in the applicable SOW and attorney engagement letter, The Atoll Group's attorney providing such guidance is duly licensed and in good standing in all jurisdictions in which such attorney is admitted to practice and is not subject to any disciplinary proceedings, sanctions, or restrictions that would materially impair the attorney's ability to provide such guidance; and

(d) all legal guidance provided pursuant to an attorney engagement letter will be performed in accordance with the professional standards of care applicable to attorneys practicing in the relevant jurisdiction(s) and subject matter area(s), exercising the degree of skill and diligence ordinarily employed by competent attorneys performing similar services under similar circumstances.

7.3 Client Warranties. Client warrants that it has all necessary rights and authorizations to provide The Atoll Group with access to its systems, data, and facilities as required for the performance of the Services, and that such access will not violate any third-party rights or applicable law.

8. Limitation of Liability

8.1 Liability Cap. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE ATOLL GROUP'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS OR ANY SOW FOR CONSULTING SERVICES (EXCLUDING LEGAL GUIDANCE), WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, WILL NOT EXCEED THE TOTAL FEES ACTUALLY PAID BY CLIENT TO THE ATOLL GROUP UNDER THE APPLICABLE SOW DURING THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

8.1.1 Legal Guidance Liability Cap. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW AND APPLICABLE RULES OF PROFESSIONAL CONDUCT, THE ATOLL GROUP'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO LEGAL GUIDANCE PROVIDED PURSUANT TO AN ATTORNEY ENGAGEMENT LETTER, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE AND PROFESSIONAL MALPRACTICE), OR OTHERWISE, WILL NOT EXCEED [THE GREATER OF: (A) THREE TIMES (3X) THE TOTAL FEES ACTUALLY PAID BY CLIENT FOR THE LEGAL GUIDANCE UNDER THE APPLICABLE SOW OR ATTORNEY ENGAGEMENT LETTER DURING THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM; OR (B) THE LIMITS OF THE ATOLL GROUP'S PROFESSIONAL LIABILITY INSURANCE COVERAGE APPLICABLE TO THE CLAIM]. THE ENFORCEABILITY OF THIS CAP IS SUBJECT TO THE REQUIREMENTS OF APPLICABLE STATE BAR RULES AND PROFESSIONAL CONDUCT REGULATIONS GOVERNING THE LIMITATION OF LIABILITY FOR LEGAL SERVICES.

8.2 Exclusion of Consequential Damages. IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, REVENUE, DATA, OR BUSINESS OPPORTUNITY, REGARDLESS OF WHETHER SUCH DAMAGES WERE FORESEEABLE OR WHETHER THE PARTY WAS ADVISED OF THE POSSIBILITY THEREOF. WITH RESPECT TO CLAIMS ARISING FROM LEGAL GUIDANCE, THIS EXCLUSION APPLIES ONLY TO THE EXTENT PERMITTED BY APPLICABLE RULES OF PROFESSIONAL CONDUCT AND APPLICABLE LAW.

8.3 Exceptions. The limitations in Sections 8.1 and 8.2 will not apply to: (a) either party's breach of Section 4 (Confidentiality); (b) either party's indemnification obligations under Section 9; (c) The Atoll Group's liability for gross negligence or willful misconduct; (d) Client's obligation to pay fees; or (e) claims arising from The Atoll Group's fraud, intentional misrepresentation, or knowing violation of applicable rules of professional conduct in connection with legal guidance.

9. Indemnification

9.1 By The Atoll Group. The Atoll Group will defend, indemnify, and hold harmless Client and its officers, directors, and employees from and against any third-party claims, damages, losses, and reasonable attorneys' fees arising from: (a) The Atoll Group's gross negligence or willful misconduct in connection with consulting Services (excluding legal guidance); or (b) The Atoll Group's infringement of a third party's intellectual property rights through the deliverables.

9.1.1 By The Atoll Group (Legal Guidance). The Atoll Group will defend, indemnify, and hold harmless Client and its officers, directors, and employees from and against any third-party claims, damages, losses, and reasonable attorneys' fees arising from: (a) professional malpractice by The Atoll Group's attorney in the performance of legal guidance under an attorney engagement letter; (b) a breach of the attorney's duty of competence, diligence, or loyalty owed to Client under applicable rules of professional conduct; or (c) the attorney's knowing or reckless provision of legal guidance that violates applicable law or rules of professional conduct. The Atoll Group will maintain professional liability insurance with coverage limits of not less than $[amount] per claim and $[amount] in the aggregate, covering both consulting and legal services. The Atoll Group will provide Client with a certificate of insurance upon request.

9.2 By Client. Client will defend, indemnify, and hold harmless The Atoll Group and its officers, directors, and employees from and against any third-party claims, damages, losses, and reasonable attorneys' fees arising from: (a) Client's use of the deliverables in violation of these Terms; (b) Client's failure to implement recommendations or follow legal guidance where such failure results in claims against The Atoll Group; (c) Client's provision of data or system access in violation of applicable law or third-party rights; or (d) Client's use of legal guidance for purposes or matters beyond the scope identified in the applicable SOW or attorney engagement letter.

9.3 Procedure. The indemnified party will provide prompt written notice of any claim, grant the indemnifying party sole control over the defense and settlement (provided that the indemnifying party may not settle any claim that imposes obligations on the indemnified party without its prior written consent), and provide reasonable cooperation at the indemnifying party's expense. With respect to claims arising from legal guidance, the defense and settlement of such claims will be managed in a manner consistent with the applicable rules of professional conduct, including any obligations regarding reporting to state bar authorities.

10. Term and Termination

10.1 Term. These Terms are effective as of the date Client first engages The Atoll Group for Services and continue until all SOWs have been completed or terminated, unless earlier terminated in accordance with this Section.

10.2 Termination for Convenience. Either party may terminate a SOW upon thirty (30) days' prior written notice to the other party. Client will pay for all Services performed and expenses incurred through the effective date of termination.

10.3 Termination for Cause. Either party may terminate these Terms or any SOW immediately upon written notice if the other party: (a) materially breaches these Terms and fails to cure such breach within thirty (30) days after receiving written notice; or (b) becomes insolvent, files for bankruptcy, or has a receiver appointed for a substantial portion of its assets.

10.4 Effect of Termination. Upon termination: (a) Client will pay all outstanding fees for Services rendered through the date of termination; (b) each party will return or destroy the other party's Confidential Information, except as required by law or regulation; and (c) Sections 4, 5, 7, 8, 9, 11, and 12 will survive termination.

11. Dispute Resolution

11.1 Governing Law. These Terms are governed by and construed in accordance with the laws of the State of California, without regard to its conflict-of-laws principles.

11.2 Informal Resolution. Before initiating any formal dispute resolution, the parties will attempt in good faith to resolve any dispute through direct negotiation between senior representatives of each party for a period of at least thirty (30) days.

11.3 Arbitration. Any dispute not resolved through informal negotiation will be settled by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules. The arbitration will be conducted in San Francisco, California, by a single arbitrator with relevant industry experience. The arbitrator's decision will be final and binding, and judgment on the award may be entered in any court of competent jurisdiction.

11.4 Injunctive Relief. Notwithstanding Section 11.3, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent the actual or threatened breach of Section 4 (Confidentiality) or Section 5 (Intellectual Property).

12. General Provisions

12.1 Entire Agreement. These Terms, together with all SOWs and any DPA, constitute the entire agreement between the parties concerning the subject matter hereof and supersede all prior or contemporaneous agreements, understandings, negotiations, and discussions, whether oral or written.

12.2 Amendments. These Terms may be amended only by a written instrument signed by authorized representatives of both parties.

12.3 Assignment. Neither party may assign these Terms or any SOW without the other party's prior written consent, except that either party may assign without consent in connection with a merger, acquisition, or sale of all or substantially all of its assets, provided the assignee agrees in writing to be bound by these Terms.

12.4 Force Majeure. Neither party will be liable for delays or failures in performance resulting from causes beyond its reasonable control, including natural disasters, acts of government, pandemics, cyberattacks on the affected party's own infrastructure, labor disputes, or failures of third-party telecommunications or power. The affected party will provide prompt notice and use commercially reasonable efforts to mitigate the impact.

12.5 Independent Contractor. The Atoll Group is an independent contractor. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship between the parties.

12.6 Notices. All notices under these Terms must be in writing and sent to the addresses specified in the applicable SOW, by personal delivery, nationally recognized overnight courier, or email (with confirmation of receipt). Notices are effective upon receipt.

12.7 Severability. If any provision of these Terms is held to be invalid or unenforceable, the remaining provisions will continue in full force and effect.

12.8 Waiver. No failure or delay by either party in exercising any right under these Terms constitutes a waiver of that right.

12.9 No Third-Party Beneficiaries. These Terms are for the sole benefit of the parties and their permitted successors and assigns. Nothing herein confers any rights on any third party.

12.10 Publicity. Neither party will use the other party's name, logo, trademark, or other identifying indicia in any press release, public statement, marketing material, case study, or client list without the prior written consent of the other party. Notwithstanding the foregoing, Client grants The Atoll Group the right to identify Client by name and general industry description in confidential proposals and RFP responses, provided that The Atoll Group does not disclose any details of the engagement scope, deliverables, findings, or fees. Any case study, testimonial, or public-facing reference to Client requires Client's prior written approval of the specific content, and Client may require anonymization as a condition of such approval. No approved content will include Confidential Information, security findings, vulnerability data, or any information that could compromise Client's security posture. Consent granted under this Section may be revoked by either party upon thirty (30) days' written notice, after which the other party will remove all references within a commercially reasonable timeframe. Nothing in this Section restricts disclosures required by applicable law, regulation, or legal process, subject to Section 4.4. The obligations in this Section survive termination or expiration of these Terms for a period of two (2) years.